Are gravitational waves longitudinal or transverse?

Question: Waves are generally classified as either transverse or longitudinal depending on the they way the propagated quantity is oriented with respect to the direction of propagation. Then what is a gravitational wave? It doesn't make sense to me that a disturbance in the curvature of spacetime has a "direction", so I would say they're neither, much like a wave packet in quantum mechanics.
Answer: Gravitational waves are transverse waves but they are not dipole transverse waves like most electromagnetic waves, they are quadrupole waves.  They simultaneously squeeze and stretch matter in two perpendicular directions. Gravitational waves definitely propagate in a given direction but the effect that they have on matter is completely perpendicular to the direction of motion.  Below is a picture of what the metric of a passing wave does to space (the wave traveling is perpendicular to the screen).  If you imagine a free particle sitting at each grid intersection point, the particle would move sinusoidally right along with the grid:

This diagram is from this paper
Comment: I believe this diagram that you have is for $H_+$ (H-plus ? I'm not sure how to pronounce this) gravitational waves, after you take the de Donder gauge
$$ \partial^{\mu} \bar{h}_{\mu \nu} = 0 $$
and the longitudinal gauge
$$ H_{0 \mu} = 0 $$
the transversility condition
$$ H_{\mu 0} + H_{\mu 3} = 0 $$
and finally the traceless condition
$$ H^{\mu}_{\; \mu} = 0 $$
yes?
Then the other wave is the $H_{\times}$ (again, H-cross ?) wave. Do you have a similiar diagram for this? Your diagram of the metric is far better than the usual one one finds of four test masses oscillating. Thank you.
Comment: @Flint72 - if you look at page 7 of the linked paper, you will see the orthogonal wave where the stretching and shrinking occurs at 45 degrees to the figure in the paper.  See http://www.eftaylor.com/exploringblackholes/GravWaves100707V2.pdf
Comment: Currently featured: [Under what circumstances might gravitational waves impart linear momentum to an object? (e.g. Quasar 3C 186)](http://physics.stackexchange.com/q/321166/83380); still hoping for a clearer answer on momentum transfer.
Answer: in the linearized limit of General relativity, as FrankH said, all propagating perturbations of the metric are transverse.
However, it must be noted that the full theory does allow for nonlinear longitudinal modes of propagation. According to the Petrov classification, such regions of longitudinal propagation are region III. There are usually not taken as true propagating modes since they fall of as the inverse cube of distance to the source, so they are interpreted as a kind of evanescent wave
Comment: Is this like in a waveguide for electromagnetic waves in which you can have longitudinal modes despite electromagnetic waves being generally transverse?
Comment: @Ignacio Since waveguides by definition don't propagate out in all directions, a better analogy would be to the near field of an EM transmitter. This regime has more complicated behavior, including the feedback into the transmitter that makes RFID technology possible.
Comment: +1 especially for mention of the Petrov Classification. Schutz doesn't mention it: which is an oversight because, although not "practical" for gravitational wave astronomy, to at least know that other "near field" waves exist makes the whole subject of gravitational waves much less mysterious.


Why is $\sqrt {12} = 2 \sqrt 3$?

Question: Why $\sqrt {12} = 2 \sqrt 3$? It is obvious? If we considered the function $f(s) = s^2 $ it is injective on positive numbers so we obtain the conclusion. But in  the same time it is an equality between irrational numbers. Suppose that we know just to compute the square roots.
Comment: Well, $\sqrt{\frac{1}{2}}=\frac{\sqrt2}{2}$. Irrational numbers can still be equal to one another. If this were a case of irrational$=$rational, I can see how it might be a problem, but that's not what's happening here.
Comment: Put another way, $\sqrt{12} = \sqrt{2^2 \times 3}$.
Comment: $\sqrt {ab}=\sqrt a\cdot \sqrt b$ and $\sqrt {c^2}=\pm c$. You must choose here the positive sign.
Comment: This derives from $\sqrt{ab}=\sqrt a\sqrt b$, itself from $(cd)^2=c^2d^2$.
Answer: Let's assume (unless that's the part you want proven) that there is only 1 positive number $x$ with the property $x^2=12$.  We'll denote that number by $\sqrt{12}$.  Likewise let $\sqrt{3}$ be the positive $y$ such that $y^2=3$.
We know that $\Bbb R$ is a field and thus multiplication is commutative.  We also know that because $2\gt 0$ and $\sqrt{3}\gt 0$ that $2\sqrt{3}\gt 0$. Then $$(2\sqrt{3})^2 = (2\sqrt{3})(2\sqrt{3}) = (2^2)(\sqrt{3})^2 = 4\cdot 3=12=\sqrt{12}^2 \\ \implies 2\sqrt{3}=\sqrt{12}$$
Comment: I don't know what you mean by "computing" the square roots.  If you mean using one of the myriad methods of finding a rational number that approximates the square root to whatever precision we like, then we still need a definition of the number to know if our approximation is at all good.  That definition is $\sqrt{a}$ is the nonnegative number $x$ such that $x^2=a$ where $a\ge 0$.
Comment: It is just a euristic question.Let's suppose that  we know just to compute the square roots.
Answer: By definition, $\sqrt3$ is the positive number $s$ such that $s^2=3.$ Likewise, $\sqrt{12}$ is the positive number $t$ such that $t^2=12.$ The claim, then, is that $t=2s,$ but is it true? Well, $2s$ is a positive number, since it is a product of two positive numbers. Moreover, $$(2s)^2=2^2s^2=4s^2=4\cdot 3=12.$$ Hence, $2s=t,$ as desired.
Comment: It is a truly terrible idea to try checking the decimal expansions to see if two irrational numbers are equal. Who can ever check infinitely-many digits? Likewise, it isn't necessary to check digits in the rational case! By definition, $\frac12$ is the number $s$ such that $2s=1;$ $\frac24,$ the number $t$ such that $4t=2$. Since $$4s=2\cdot2s=2\cdot1=2,$$ then $s=t,$ meaning that $\frac12=\frac24.$
Comment: I am agree , but my question  is like that:2/4=1/2 because they are 0,5.They have the same  digits
Comment: $\sqrt{12}$ and $2\sqrt{3}$ also have all the same digits. They just happen to have infinitely-many digits, and those digits don't eventually cycle.
Comment: More briefly, $\frac12=\frac24$ because $1\cdot4=2\cdot2.$ Likewise, $\frac24=\frac5{10}$ because $2\cdot10=4\cdot5.$ By transitivity of equality, $\frac12=\frac5{10}.$ Recalling that $0.5$ is simply another way of writing $\frac5{10},$ we're done. No calculator or computer required.
Answer: Since,$$12 = 4\times 3 = 2^2 \times 3$$
$$\sqrt{12} = \sqrt{2^2\times 3} = \sqrt{2^2}\times\sqrt{3}=2\sqrt{3}$$
Comment: but he asks why $\sqrt{4}=2$ not $\sqrt{4}=-2.$
Comment: No.My question is:Why they are equal.They are irațional numbers , if we compute the square roots.
Comment: @Leox: I don't think the OP is asking about this.
Answer: Let's consider
\begin{aligned}
f : \mathbf{R_+} &\to \mathbf{R_+}\\
x &\to x^2
\end{aligned}
then $f$ is bijection, for it is strictly increasing.
$f(\sqrt{12}) = f(2\sqrt{3}) = 12$, so $\sqrt{12} = 2\sqrt{3}$.
Note that $\sqrt{12}$ is just a notation, there is no problem to denote one number with different notations. For example, we can also use
$[3, \overline{[2,6]}]$ which means to be a continued fraction to denote $\sqrt{12}$.
Comment: @Bye_World ah, It is surely a mistake. I have corrected it. Thanks!

Why is $\sqrt {12} = 2 \sqrt 3$?


Baofeng Orange Transmit light comes on by itself (triggered by sound)

Question: I have a BTech UV-5X3 and if I yell or blow into the mic, the transmit lights (red indicator light and orange backlight) come on as though I'm hitting the PTT button. Is this normal and am I actually transmitting when this happens?
Comment: One assumes you've looked in the manual and online before raising this question? Welcome to Ham.SE! If you have not already done so, please take the [tour] to get a feel for what SE sites are all about.
Answer: It sounds like you have a "VOX" setting enabled, where any significant sound at the microphone causes the PTT circuit to be enabled, usually after a little delay.
Search for "vox" or "voice" similar in the manual.
To test this, just see if a local repeater responds when you do this. Assuming you can legally try saying "ZZ1ABC testing" to that repeater where you are.
A friend with another radio could also help you test using the free bands if you can't use the amateur bands.
Answer: I agree with @clvrmky that the situation sounds exactly like how voice-activated ("VOX") mode works. Basically it's a setting that lets you transmit just by talking, without having to use your hands. (Sometimes it's also used when a phone/computer/etc. is generating digital audio signals but doesn't have a convenient way to control the PTT line directly.)
So assuming VOX is on:

yes, you are actually transmitting when this happens
it's "normal" behavior for how the feature is supposed to work

But if you don't want to automatically transmit when the mic picks up sound, you can turn the VOX feature off.
On this style of Baofeng:

Press MENU and then 4 to go to the VOX setting
With VOX showing on the top line, press MENU to start editing its options below
Then press "0" to jump to the "OFF" setting (or arrow up/down until you find it)
Finally, press MENU to save the new setting (or EXIT to cancel)
When you're done editing, you can press EXIT to leave the menu (or up/down to browse other settings — see the manual for what they all mean).

When you start at steps 1/2 it will probably show a number instead of "OFF" right now. Any number enables the VOX feature but it activates at different sensitivity levels, so you could choose how little/much mic input is needed to trigger transmission.
Comment: Nice that you showed the actual steps to configure this rig.


Removing the surface layer from ceramic tile

Question: I have green tile in my bathroom with pink accents.  Is it possible to remove the pink using muriatic acid (concentrated HCL)?  I have a background in clinical and chemistry laboratory sciences and am more than aware of the safety gear and precautions required.  Has anyone used this approach?
Comment: What do you mean by "accents"?
Comment: You want to remove the glaze from the ceramic backing? Egads.
Answer: My mom used to do ceramics the accents are small bits of pigment in the glaze these are baked and become part of the surface, removing the accents would ruin the seal of the glaze. Replacing the tile would be a better way to go than trying to etch just the accents as this will also discolor the green part of the glaze.
Answer: Most likely the accents in question are under or part of the glaze. Glaze on ceramics is basically glass melted on to the surface of the ceramic. This gives you two problems.

Most acids (including HCl) won't touch glass.
If you do succeed in removing the glaze you will have removed what seals the tile against water and gives it a smooth surface for cleaning.
Comment: And #3, there's not really a way to replace damaged glaze that would come close to the original durability.


activerecord and timezones

Question: Here's the situation.  We have a rails 3.2 app running on heroku, and developers all over the world.  We want to standardise on UTC for everything.  Our team speaks UTC even among ourselves (eg. when planning meeting times).  We want the app to do the same.  We can convert things back into people's local timezones for display at some later point.
The problem is that when I save something into the database (for instance, creating a new post in the forums) it thinks that my local time (as reported by my computer) is UTC, and saves it as such.
For example, it's lunchtime on Thursday 14th February here in sunny Melbourne, Australia (UTC+11).  I make a new post, then look in the console:
1.9.3p194 :009 > p = Post.first
 => #<Post id: 12, author_id: 1, subject: "Another post ", body: "a very recent one!", created_at: "2013-02-14 12:13:53", updated_at: "2013-02-14 12:13:53", slug: "test1-20130214-another-post", forum_id: 1>
1.9.3p194 :010 > p.created_at
 => Thu, 14 Feb 2013 12:13:53 UTC +00:00

As you can see, the created_at timestamp is saved as per lunchtime on the 14th, and flagged as being that time IN UTC.  What I actually want is for it to look at the local time, be aware that I'm in Melbourne, and convert to UTC by (in this case) subtracting 11 hours.
Now, I know I can edit these lines in my config/application.rb:
config.time_zone = 'UTC'
config.active_record.default_timezone = 'UTC'

(I think changing config.time_zone to 'Australia/Melbourne' would fix it? Probably?)
However, if I change any of that to "Australia/Melbourne" (or whatever), then what happens to our deployed app (on Heroku), and my co-developers in Maryland and Oregon and Glasgow?  Do we all have to set our times individually?  Should we do it via environment variables, perhaps?  Any other suggestions?
Answer: OK, so it looks like this fixes it for us:
config.time_zone = 'UTC'
config.active_record.default_timezone = :local

We're a little dubious and will wait and see how it goes when we deploy and/or run our test suite in everyone's timezones, but for now it seems like it works... in Melbourne at least ;)
Comment: You can set the timezone in your Postgres database as well, but I believe your app still needs the configs you used above

activerecord and timezones


How does a socket know which network interface controller to use?

Question: If a computer has multiple network cards, all of them connected to different networks and functioning properly, when we open a socket, how does the OS determine which NIC to use with this socket? Does the socket API allow us to explicitly specify the NIC that is to be used?
Answer: I'm writing this from a Linux perspective, but I suppose it applies everywhere.
The decision is made when the socket is bound. When bind is called, the address you specify determines the interface the socket will listen on. (Or even all interfaces.)
Even if you don't use bind, it happens implicitly when you connect. The destination is looked up in the route table, which must contain a route to the destination network. The route also contains the interface to use and can optionally even specify the source address. If no source address is specified, the primary address of the interface is taken.
You can actually use bind together with connect, to force your outgoing connection to use a specific address and port. A socket must always have these two bits of information, so even when you don't, the primary address is used and a random port are chosen.
Comment: "When bind is called, the address you specify determines the interface the socket will listen on." How does the `bind` determine this? What if you have several interfaces on the same subnet?
Comment: @flow2k when you `bind()` to an IP, you are binding to the specific interface that the IP belongs to. You can't have multiple interfaces with the same IP.
Comment: What if I have bind my socket to an ip address which doesn't match with any of the interfaces? Then is there any NAT done by Kernel?
Comment: If I bind an interface before to connect, Does that mean the connect for outgoing traffic will use that interface I bind without following the routing decision?
Comment: @abhiarora if the IP doesn't exist, the `bind()` will fail.
Answer: I dont know why im included in the edit suggestion when i was not even related to this question .I got similar edit suggestion before as well..might be some bug/issue.
(If you feel inclined to up-vote, @Shtééf's answer deserves it more than mine.)
That depends on whether you are connecting or binding.
If you bind, you can bind to a specific IP address corresponding to one of the machine's interfaces, or you can bind to 0.0.0.0, in which case the socket will listen on all interfaces.
If you connect an unbound socket, then the machine's routing tables, in conjunction with the destination IP adress, will determine which interface the connection request goes out on.
It is possible to bind a socket then connect it. In this case, the socket will remain bound as per the bind call when it makes the connection. (Thanks to @RemyLebeau for pointing this out.)
Comment: Unless you call bind() before calling connect().
Comment: I don't know what "weak end" and "strong end" refer to, but every platform I know of that supports sockets allow `bind()` to be called before `connect()` when a client needs to use a specific IP/adapter for the outbound connection. If `bind()` is not called beforehand, `connect()` decides which one to use.
Comment: @RemyLebeau I wasn't clear. The part that isn't necessarily true is the implication that if you bind to a specific interface, the connection request will go out on that interface. The weak-end system model allows that not to be the case. If you don't know what the strong and weak-end system models are, you could always look them up. In the RFCs.
Comment: If you bind to an interface before connecting, the local address of the connection is bound, the connection request HAS to use that interface, or it violates the binding.
Comment: @RemyLebeau Actually that's not necessarily true. There's a long discussion in one of the TCP RFC's about 'strong and weak end system models', and the conclusion is that TCP only requires the 'weak end' model. What you say is only true of the 'strong end' model.
Comment: @RemyLebeau If I bind an interface before to connect, Does that mean the connect for outgoing traffic will use that interface I bind without follow the routing decision?
Comment: @nuclear yes, if you `bind()` to an interface before `connect()`'ing, the connection will go out through that interface. That is the whole point.
Comment: @RemyLebeau but according to the docs https://linux.die.net/man/7/socket said, SO_BINDTODEVICE only impact inbound traffic, not outgoing packet `If a socket is bound to an interface, only packets received from that particular interface are processed by the socket.`
Comment: @RemyLebeau https://stackoverflow.com/a/33921305/7529562  author said `no matter which interface the socket is bound, the packet is to be routed based on route table.` Does he is wrong?
Answer: I'm not really sure which method is the best, but there is an alternative theory to the bind()-before-connect() approach that Shtééf presented. It's to use setsockopt() with SO_BINDTODEVICE . See: http://codingrelic.geekhold.com/2009/10/code-snippet-sobindtodevice.html
Answer: As an alternative, you can search for the appropriate nic based on its name:
        //Find the ip address based on the ethernet adapter name. On my machine the ethernet adapter is "Ethernet"
        System.Net.NetworkInformation.NetworkInterface[] nics = System.Net.NetworkInformation.NetworkInterface.GetAllNetworkInterfaces();
        System.Net.NetworkInformation.NetworkInterface ethernet = nics.Where(n => n.Name.Equals("Ethernet")).Single();
        UnicastIPAddressInformation uniCastIPAddressInformation = ethernet.GetIPProperties().UnicastAddresses.Where(a => a.Address.AddressFamily == System.Net.Sockets.AddressFamily.InterNetwork).Single();

        IPEndPoint localEndPoint = new IPEndPoint(uniCastIPAddressInformation.Address, 9000);

        //Create a TCP/IP socket.
        Socket listener = new Socket(AddressFamily.InterNetwork, SocketType.Stream, ProtocolType.Tcp);
        //Bind and start listening
        listener.Bind(localEndPoint);
        listener.Listen(10);


What are the pros and cons to keeping SQL in Stored Procs versus Code

Question: What are the advantages/disadvantages of keeping SQL in your C# source code or in Stored Procs? I've been discussing this with a friend on an open source project that we're working on (C# ASP.NET Forum). At the moment, most of the database access is done by building the SQL inline in C# and calling to the SQL Server DB. So I'm trying to establish which, for this particular project, would be best.
So far I have:
Advantages for in Code:

Easier to maintain - don't need to run a SQL script to update queries
Easier to port to another DB - no procs to port

Advantages for Stored Procs:

Performance
Security
Comment: You could also argue that Stored Procs make maintenance easier - you don't need to re-deploy the whole application just to change one query.
Comment: @GvS: that is a dysfunction of your company, not a best practice.  Of course it is easier to change things in 1 place than 1000.  The DBAs are simply doing their part to prevent cavalier changes to the system, and that should be respected.
Answer: I am not a fan of stored procedures

Stored Procedures are MORE maintainable because:
     * You don't have to recompile your C# app whenever you want to change some SQL

You'll end up recompiling it anyway when datatypes change, or you want to return an extra column, or whatever. The number of times you can 'transparently' change the SQL out from underneath your app is pretty small on the whole

You end up reusing SQL code.

Programming languages, C# included, have this amazing thing, called a function. It means you can invoke the same block of code from multiple places! Amazing! You can then put the re-usable SQL code inside one of these, or if you want to get really high tech, you can use a library which does it for you. I believe they're called Object Relational Mappers, and are pretty common these days.

Code repetition is the worst thing you can do when you're trying to build a maintainable application!

Agreed, which is why storedprocs are a bad thing. It's much easier to refactor and decompose (break into smaller parts) code into functions than SQL into... blocks of SQL?

You have 4 webservers and a bunch of windows apps which use the same SQL code Now you realized there is a small problem with the SQl code so do you rather...... change the proc in 1 place or push the code to all the webservers, reinstall all the desktop apps(clickonce might help) on all the windows boxes

Why are your windows apps connecting directly to a central database? That seems like a HUGE security hole right there, and bottleneck as it rules out server-side caching. Shouldn't they be connecting via a web service or similar to your web servers?
So, push 1 new sproc, or 4 new webservers?
In this case it is easier to push one new sproc, but in my experience, 95% of 'pushed changes' affect the code and not the database. If you're pushing 20 things to the webservers that month, and 1 to the database, you hardly lose much if you instead push 21 things to the webservers, and zero to the database.

More easily code reviewed.

Can you explain how? I don't get this. Particularly seeing as the sprocs probably aren't in source control, and therefore can't be accessed via web-based SCM browsers and so on.
More cons:
Storedprocs live in the database, which appears to the outside world as a black box. Simple things like wanting to put them in source control becomes a nightmare.
There's also the issue of sheer effort. It might make sense to break everything down into a million tiers if you're trying to justify to your CEO why it just cost them 7 million dollars to build some forums, but otherwise creating a storedproc for every little thing is just extra donkeywork for no benefit.
Answer: This is being discussed on a few other threads here currently.  I'm a consistent proponent of stored procedures, although some good arguments for Linq to Sql are being presented.
Embedding queries in your code couples you tightly to your data model.  Stored procedures are a good form of contractual programming, meaning that a DBA has the freedom to alter the data model and the code in the procedure, so long as the contract represented by the stored procedure's inputs and outputs is maintained.
Tuning production databases can be extremely difficult when the queries are buried in the code and not in one central, easy to manage location.
[Edit] Here is another current discussion
Answer: In my opinion you can't vote for yes or no on this question. It totally depends on the design of your application.
I totally vote against the use of SPs in an 3-tier environment, where you have an application server in front. In this kind of environment your application server is there to run your business logic. If you additionally use SPs you start distributing your implementation of business logic all over your system and it will become very unclear who is responsible for what. Eventually you will end up with an application server that will basically do nothing but the following:
<code>(Pseudocode)

Function createOrder(Order yourOrder)
Begin
  Call SP_createOrder(yourOrder)
End
</code>
So in the end you have your middle tier running on this very cool 4 Server cluster each of them equipped with 16 CPUs and it will actually do nothing at all! What a waste!
If you have a fat gui client that directly connects to your DB or maybe even more applications it's a different story. In this situation SPs can serve as some sort of pseudo middle tier that decouples your application from the data model and offers a controllable access.
Answer:
Advantages for in Code:

Easier to maintain - don't need to run a SQL script to update queries
Easier to port to another DB - no procs to port

Actually, I think you have that backwards. IMHO, SQL in code is pain to maintain because:

you end up repeating yourself in related code blocks
SQL isn't supported as a language in many IDE's so you have just a series of un-error checked strings performing tasks for you
changes in a data type, table name or constraint are far more prevalent than swapping out an entire databases for a new one
your level of difficulty increases as your query grows in complexity
and testing an inline query requires building the project

Think of Stored Procs as methods you call from the database object - they are much easier to reuse, there is only one place to edit and in the event that you do change DB providers, the changes happen in your Stored Procs and not in your code.
That said, the performance gains of stored procs is minimal as Stu said before me and you can't put a break point in a stored procedure (yet).
Answer: CON
I find that doing lots of processing inside stored procedures would make your DB server a single point of inflexibility, when it comes to scaling your act.
However doing all that crunching in your program as opposed to the sql-server,  might allow you to scale more if you have multiple servers that runs your code. Of-course this does not apply to stored procs that only does the normal fetch or update but to ones that perform more processing like looping over datasets.
PROS

Performance for what it may be worth (avoids query parsing by DB driver / plan recreation etc)
Data manipulation is not embedded in the C/C++/C# code which means I have less low level code to look through. SQL is less verbose and easier to look through when listed separately.
Due to the separation folks are able to find and reuse SQL code much easier.
Its easier to change things when schema changes - you just have to give the same output to the code and it will work just fine
Easier to port to a different database.
I can list individual permissions on my stored procedures and control access at that level too.
I can profile my data query/ persistence code separate from my data transformation code.
I can implement changeable conditions in my stored procedure and it would be easy to customize at a customer site.
It becomes easier to use some automated tools to convert my schema and statements together rather than when it is embedded inside my code where I would have to hunt them down.
Ensuring best practices for data access is easier when you have all your data access code inside a single file - I can check for queries that access the non performant table or that which uses a higher level of serialization or select *'s in the code etc.
It becomes easier to find schema changes / data manipulation logic changes when all of it is listed in one file.
It becomes easier to do search and replace edits on SQL when they are in the same place e.g. change / add transaction isolation statements for all stored procs.
I and the DBA guy find that having a separate SQL file is easier / convenient when the DBA has to review my SQL stuff.
Lastly you don't have to worry about SQL injection attacks because some lazy member of your team did not use parametrized queries when using embedded sqls.
Answer: The performance advantage for stored procedures is often negligable.
More advantages for stored procedures:

Prevent reverse engineering (if created With Encryption, of course)
Better centralization of database access
Ability to change data model transparently (without having to deploy new clients); especially handy if multiple programs access the same data model
Answer: I fall on the code side.  We build data access layer that's used by all all the apps (both web and client), so it's DRY from that perspective.  It simplifies the database deployment because we just have to make sure the table schema's are correct.  It simplifies code maintenance because we don't have to look at source code and the database.
I don't have much problem with the tight coupling with the data model because I don't see where it's possible to really break that coupling.  An application and its data are inherently coupled.
Answer: Stored procedures.
If an error slips or the logic changes a bit, you do not have to recompile the project. Plus, it allows access from different sources, not just the one place you coded the query in your project.
I don't think it is harder to maintain stored procedures, you should not code them directly in the database but in separate files first, then you can just run them on whatever DB you need to set-up.
Comment: If you find yourself making basic architectural decisions to avoid recompiling your code, then before doing anything at all, establish build process that doesn't totally suck. This is a non-argument.
Answer: Advantages for Stored procedures:
More easily code reviewed.
Less coupled, therefore more easily tested.
More easily tuned.
Performance is generally better, from the point of view of network traffic - if you have a cursor, or similar, then there aren't multiple trips to the database
You can protect access to the data more easily, remove direct access to the tables, enforce security through the procs - this also allows you to find relatively quickly any code that updates a table.
If there are other services involved (such as Reporting services), you may find it easier to store all of your logic in a stored procedure, rather than in code, and having to duplicate it
Disadvantages:
Harder to manage for the developers: version control of the scripts: does everyone have their own database, is the version control system integrated with the database and IDE?
Comment: Yes you can have a version control in Stored procedures and database in visual studio 2012 database project and tfs.
Answer: In some circumstances, dynamically created sql in code can have better performance than a stored proc. If you have created a stored proc (let's say sp_customersearch) that gets extremely complicated with dozens of parameters because it must be very flexible, you can probably generate a much simpler sql statement in code at runtime.
One could argue that this simply moves some processing from SQL to the web server, but in general that would be a good thing.
The other great thing about this technique is that if you're looking in SQL profiler you can see the query you generated and debug it much easier than seeing a stored proc call with 20 parameters come in.
Comment: Not sure why this answer was voted down.. it's true that a smaller query can perform better.  This has even been commented on by the SQL Server team.
Answer: I like stored procs, dont know how many times I was able to make a change to an application using a stored procedure which didn't produce any downtime to the application.
Big fan of Transact SQL, tuning large queries have proven to be very useful for me. Haven't wrote any inline SQL in about 6 years!
Comment: I just can't understand another point of view using querries in code, just can't understand...
Answer: You list 2 pro-points for sprocs:
Performance - not really.  In Sql 2000 or greater the query plan optimisations are pretty good, and cached. I'm sure that Oracle etc do similar things.  I don't think there's a case for sprocs for performance any more.
Security? Why would sprocs be more secure? Unless you have a pretty unsecured database anyway all the access is going to be from your DBAs or via your application. Always parametrise all queries - never inline something from user input and you'll be fine.
That's best practice for performance anyway.
Linq is definitely the way I'd go on a new project right now. See this similar post.
Comment: Procs are by far the most secure way to go. They limit the user from only taking the actions in the procs. They can't go directly to a table or view that they have write access to and change things. Procs are necessary to prevent harm from internal threats.
Comment: Ad-hoc SQL execution plans are only reused in specific circumstances:
http://tinyurl.com/6x5lmd [SO answer with code proof]
LINQ to SQL is officially dead:
http://tinyurl.com/6298nd [blog post]
Answer: @Keith

Security? Why would sprocs be more secure?

As suggested by Komradekatz, you can disallow access to tables (for the username/password combo that connects to the DB) and allow SP access only. That way if someone gets the username and password to your database they can execute SP's but can't access the tables or any other part of the DB.
(Of course executing sprocs may give them all the data they need but that would depend on the sprocs that were available. Giving them access to the tables gives them access to everything.)
Comment: @Joe Philllips, views do not give you better or even equal security to procs and they will NOT be useful in preventing fraud or internal harm. When you use procs the scurity model is that they users only get access to the proc not the tables or views and thus they cannot do anything except what a proc does. If you have financial data and you aren't using procs, your system is at risk.
Answer: Think of it this way
You have 4 webservers and a bunch of windows apps which use the same SQL code
Now you realized there is a small problem with the SQl code
so do you rather......
change the proc in 1 place
or
push the code to all the webservers, reinstall all the desktop apps(clickonce might help) on all the windows boxes
I prefer stored procs
It is also easier to do performance testing against a proc, put it in query analyzer
set statistics io/time on
set showplan_text on and voila
no need to run profiler to see exactly what is being called
just my 2 cents
Answer: I prefer keeping in them in code (using an ORM, not inline or ad-hoc) so they're covered by source control without having to deal with saving out .sql files.
Also, stored procedures aren't inherently more secure. You can write a bad query with a sproc just as easily as inline. Parameterized inline queries can be just as secure as a sproc.
Answer: Use your app code as what it does best: handle logic.
User your database for what it does best: store data.
You can debug stored procedures but you will find easier to debug and maintaing logic in code.
Usually you will end recompiling your code every time you change the database model.
Also stored procedures with optional search parameters are very inneficient because you have to specify in advance all the possible parameters and complex searches are sometimes not possible because you cant predict how many times a parameter is going to be repeated in the seach.
Comment: multiple apps shouldn't be making the same type of changes to the database.  there should be one app component that deals with a single type of changes.  Then that app should expose a service if others are interested.  Multiple apps changing the same database/table in whatever way they see fit is what causes a system of apps and the database to become unmaintainable.
Comment: When multiple apps hit the same database, and databases are affected by imports and other direct access (update all the prices by 10%), the logic must be in the database or you will lose database integrity.
Comment: " there should be one app component that deals with a single type of changes" -- That component could be a stored procedure, say in PL/SQL.
Comment: For the case of multiple apps, placing the logic into a library which is used by all apps allows integrity to be maintained while still keeping the logic in the app language.  For imports/direct access, it's generally situational as to whether the rules which apply to apps should be enforced or not.
Answer: When it comes to security, stored procedures are much more secure. Some have argued that all access will be through the application anyway. The thing that many people are forgetting is that most security breaches come from inside a company. Think about how many developers know the "hidden" user name and password for your application?
Also, as MatthieuF pointed out, performance can be much improved due to fewer round trips between the application (whether it's on a desktop or web server) and the database server.
In my experience the abstraction of the data model through stored procedures also vastly improves maintainability. As someone who has had to maintain many databases in the past, it's such a relief when confronted with a required model change to be able to simply change a stored procedure or two and have the change be completely transparent to ALL outside applications. Many times your application isn't the only one pointed at a database - there are other applications, reporting solutions, etc. so tracking down all of those affected points can be a hassle with open access to the tables.
I'll also put checks in the plus column for putting the SQL programming in the hands of those who specialize in it, and for SPs making it much easier to isolate and test/optimize code.
The one downside that I see is that many languages don't allow the passing of table parameters, so passing an unknown number data values can be annoying, and some languages still can't handle retrieving multiple resultsets from a single stored procedure (although the latter doesn't make SPs any worse than inline SQL in that respect).
Comment: When the model changes, usually the code needs to change as well regardless of whether one is using sprocs or dynamic sql.  And once you create tables/schema how often do you change just the table/schema?  Not often.  Usually changes come from business where they need to add another column or another table, in which case, I doubt you can do without a code change.
Answer: One of the suggestions from a Microsoft TechEd sessions on security which I attended, to make all calls through stored procs and deny access directly to the tables.  This approach was billed as providing additional security.  I'm not sure if it's worth it just for security, but if you're already using stored procs, it couldn't hurt.
Comment: Data security is important when you are deling with personal information or finanical imformation especially. Most fraud is committed by insiders. You don't want to give them the access they need to bypass internal controls.
Answer: Definitely easier to maintain if you put it in a stored procedure.  If there's difficult logic involved that will potentially change in the future it is definitely a good idea to put it in the database when you have multiple clients connecting.  For example I'm working on an application right now that has an end user web interface and an administrative desktop application, both of which share a database (obviously) and I'm trying to keep as much logic on the database as possible.  This is a perfect example of the DRY principle.
Answer: I'm firmly on the side of stored procs assuming you don't cheat and use dynamic SQL in the stored proc. First, using stored procs allows the dba to set permissions at the stored proc level and not the table level. This is critical not only to combating SQL injection attacts but towards preventing insiders from directly accessing the database and changing things. This is a way to help prevent fraud. No database that contains personal information (SSNs, Credit card numbers, etc) or that in anyway creates financial transactions should ever be accessed except through strored procedures. If you use any other method you are leaving your database wide open for individuals in the company to create fake financial transactions or steal data that can be used for identity theft.
Stored procs are also far easier to maintain and performance tune than SQL sent from the app. They also allow the dba a way to see what the impact of a database structural change will have on the way the data is accessed. I've never met a good dba who would allow dynamic access to the database.
Answer: We use stored procedures with Oracle DB's where I work now.  We also use Subversion.  All the stored procedures are created as .pkb & .pks files and saved in Subversion.  I've done in-line SQL before and it is a pain!  I much prefer the way we do it here.  Creating and testing new stored procedures is much easier than doing it in your code.
Theresa
Answer: Smaller logs
Another minor pro for stored procedures that has not been mentioned: when it comes to SQL traffic, sp-based data access generates much less traffic. This becomes important when you monitor traffic for analysis and profiling - the logs will be much smaller and readable.
Answer: I'm not a big fan of stored procedures, but I use them in one condition:
When the query is pretty huge, it's better to store it in the database as a stored procedure instead of sending it from the code. That way, instead of sending huge ammounts of string characters from the application server to the database, only the <code>"EXEC SPNAME"</code> command will be sent.
This is overkill when the database server and the web server are not on the same network (For example, internet communication). And even if that's not the case, too much stress means a lot of wasted bandwith.
But man, they're so terrible to manage. I avoid them as much as I can.
Answer: A SQL stored proc doesn't increase the performance of the query
Comment: How it can be not ? Please Explain about this.
Comment: It will increase the performance if the SQL query can be compiled.
Answer: Well obviously using stored procedures has several advantages over constructing SQL in code.

Your code implementation and SQL become independent of each other.
Code is easier to read.
Write once use many times.
Modify once
No need to give internal details to the programmer about the database. etc , etc.
Comment: I've never been in a situation where having less info about a code problem or new feature has been of benefit to me, could you clarify number 5?
Answer: Something that I haven't seen mentioned thus far: the people who know the database best aren't always the people that write the application code. Stored procedures give the database folks a way to interface with programmers that don't really want to learn that much about SQL. Large--and especially legacy--databases aren't the easiest things to completely understand, so programmers might just prefer a simple interface that gives them what they need: let the DBAs figure out how to join the 17 tables to make that happen.
That being said, the languages used to write stored procedures (PL/SQL being a notorious example) are pretty brutal. They typically don't offer any of the niceties you'd see in today's popular imperative, OOP, or functional languages. Think COBOL.
So, stick to stored procedures that merely abstract away the relational details rather than those that contain business logic.
Comment: "The languages used to write stored procedures (PL/SQL being a notorious example) are pretty brutal [and] don't offer any of the niceties you'd see in today's popular languages." You need to re-read the PL/SQL docs (http://download.oracle.com/docs/cd/B28359_01/appdev.111/b28370/toc.htm). PL/SQL has encapsulation using packages, OOP via object types, exception handling, dynamic execution of code, debuggers, profilers, etc., plus hundreds of standard, Oracle-supplied packages/libraries for doing everything from HTTP calls to encryption and regular expressions. PL/SQL has LOTS of niceties.
Answer: Stored Procedures are MORE maintainable because:

You don't have to recompile your C# app whenever you want to change some SQL
You end up reusing SQL code.

Code repetition is the worst thing you can do when you're trying to build a maintainable application!
What happens when you find a logic error that needs to be corrected in multiple places? You're more apt to forget to change that last spot where you copy & pasted your code.
In my opinion, the performance & security gains are an added plus. You can still write insecure/inefficient SQL stored procedures.

Easier to port to another DB - no procs to port

It's not very hard to script out all your stored procedures for creation in another DB. In fact - it's easier than exporting your tables because there are no primary/foreign keys to worry about.
Comment: Just a note: "Easier to port to another DB - no procs to port" referred to porting to *another DBMS*, not just another installation. There are alternatives out there, you know ;-).
Answer: @Terrapin - sprocs are just as vulnerable to injection attacks. As I said:

Always parametrise all queries - never inline something from user input and you'll be fine.

That goes for sprocs and dynamic Sql.
I'm not sure not recompiling your app is an advantage. I mean, you have run your unit tests against that code (both application and DB) before going live again anyway.

@Guy - yes you're right, sprocs do let you control application users so that they can only perform the sproc, not the underlying action.
My question would be: if all the access it through your app, using connections and users with limited rights to update/insert etc, does this extra level add security or extra administration?
My opinion is very much the latter. If they've compromised your application to the point where they can re-write it they have plenty of other attacks they can use.
Sql injections can still be performed against those sprocs if they dynamically inline code, so the golden rule still applies, all user input must always be parametrised.
Comment: It isn't just outside atacks you need to fight. You cannot allow direct access to the tables to users who could then alter the data to commit fraud.
Comment: AS a policy, stored procs should not be allowed to use dynamic sql, there is almost always a non-dynamic solution if you look for it.
Comment: SQL injection is not so effective against sprocs with dynamically-inlined code because dynamic code executes with caller permission, not owner permission (unlike static code). This is true for SQL Server - not sure about Oracle.
Answer: I generally write OO code.  I suspect that most of you probably do, too.  In that context, it seems obvious to me that all of the business logic - including SQL queries - belongs in the class definitions.  Splitting up the logic such that part of it resides in the object model and part is in the database is no better than putting business logic into the user interface.
Much has been said in earlier answers about the security benefits of stored procs.  These fall into two broad categories:
1)  Restricting direct access to the data.  This definitely is important in some cases and, when you encounter one, then stored procs are pretty much your only option.  In my experience, such cases are the exception rather than the rule, however.
2)  SQL injection/parametrized queries.  This objection is a red herring.  Inline SQL - even dynamically-generated inline SQL - can be just as fully parametrized as any stored proc and it can be done just as easily in any modern language worth its salt.  There is no advantage either way here.  ("Lazy developers might not bother with using parameters" is not a valid objection.  If you have developers on your team who prefer to just concatenate user data into their SQL instead of using parameters, you first try to educate them, then you fire them if that doesn't work, just like you would with developers who have any other bad, demonstrably detrimental habit.)
Answer: I am a huge supporter of code over SPROC's. The number one reasons is keeping the code tightly coupled, then a close second is the ease of source control without a lot of custom utilities to pull it in.
In our DAL if we have very complex SQL statements, we generally include them as resource files and update them as needed (this could be a separate assembly as well, and swapped out per db, etc...).
This keeps our code and our sql calls stored in the same version control, without "forgetting" to run some external applications for updating.
Comment: What about when you "forget" to replicate changes to tables?
Comment: Process can solve deployment issues.
Answer: @Keith

Security? Why would sprocs be more secure?

Stored procedures offer inherent protection from SQL Injection attacks.
However, you're not completely protected because you can still write stored procedures that are vulnerable to such attacks (i.e. dynamic SQL in a stored proc).
Answer: I'd like to cast another vote for using stored procs (despite the hassle they can introduce when it comes to maintenance and versioning) as a way to restrict direct access to the underlying tables for better security.
Comment: To cast your vote you just use the triangle arrow to the left of the answer you liked ;)
Answer: SQL injection attacks are on the upswing. It's very easy for someone to find this code and run injection attacks on your website. You must always always parameterize your queries. It's best to never run exec(@x) on a dynamic SQL query. It's just not a great idea to use inline SQL ever, IMO.
Stored Procedures, as argued by some, are a hassle because they are another set of items to maintain separate from your code. But they are reusable and if you end up finding a bug in your queries, you can at fix them without recompiling.
Comment: Non-sequitur.  Inline and dynamic queries can be parametrized just as easily as stored procs.
Answer: Stored procedures are the worst when they are used to stand in-between applications and the database.  Many of the reasons for their use stated above are better handled by views.
The security argument is spurious.  It just moves the security problem from the application to the database.  Code is code. I have seen stored procedures that take in SQL from the applications and use it build queries that were subject to SQL injection attacks.
In general, they tend to create a rift between so-called database developers and so-called application developers. In reality, all of the code that is written is application code, it is only a difference of the execution context.
Using rich SQL generation libraries like LINQ, Rails ActiveRecord, or Hibernate/NHibernate makes development faster. Inserting stored procedures in the mix slows it down.
Comment: I have to strongly disagree with this statement. All code is not application code, stored procs are more secure if you do not allow dynamic sql (which you should not) because then you can set security at the sp level and not the table level. This is prevent fraud.
Answer: My vote for stored procedures; as an abstraction layer close to the data, efficient with sets, reusable by many "clients" (client languages). The T-SQL language is a bit primitive (and I guess that's what most of the C# guys here at SO have been exposed to), but Oracle's PL/SQL is on par with any modern programming language.
As for version control, just put the stored procedure code in text files under version control, then run the scripts to create the procs in the database.
Answer: I prefer to use an O/R Mapper such as LLBLGen Pro.
It gives you relatively painless database portability, allows you to write your database access code in the same language as your application using strongly-typed objects and, in my opinion, allows you more flexibility in how you work with the data that you pull back.
Actually, being able to work with strongly-typed objects is reason enough to use an O/R Mapper.
Answer: One point I did not find in the other answers is the following:
If in your environment the database and its schema are the heart of the architecture and applications have a more satellite role then it may make sense to make heavier use of stored procedures, which may help provide a level base for all the applications that need to access the DB, and thus induce less code repetition (e.g. are you sure that all your DB accessing applications will always be written in C# or other .NET languages?).
If, on the other hand, the application has a more central role and the DB acts more as a backing store for the application, then it may be sensible to make less use of stored procedures and achieve reduced code repetition by providing a common persistence layer, possibly based on an ORM tool/framework.
In both cases it's important that the DB is not considered a convenient repository for stored procedures. Keep them in source files within a version control system and try and automate their deployment as much as possible (this is actually valid for all schema related artifacts).
Answer: Nobody mentioned unit testing!
If you have a saveOrder method you can call several methods inside and create a unit test for each one of those but if you are only calling a store procedure there is no way to do that.
Answer: I have yet to find a good way of easily maintaining stored procs in source control that makes it as seamless as the code base.  It just doesn't happen.  This alone makes putting the SQL in your code worthwhile for me.  Performance differences are negligible on modern systems.
Comment: What's so difficult about pressing "Generate Script" button and committing it to repository?
Comment: We have no problem keeping all stored procs in source control. Of course our dbas delete any that aren't in it.
Answer: Preference of stored procedures because:
- enable fix some  data related issues in production while system is running (this is num. one for me)
- clean contract definition between DB and program (clean separation of concerns)
- better portability to different DB vendor (if written well than code change is usually only on SP side).
- better positioned for performance tuning
Cons - problematic in case WHERE clause has great variation in used conditions and high performance is needed.
Answer: Pros to stored procedures
1). Improved security as the SQL in stored procedure is static in nature(Mostly). This will protect against SQL injection.
2). Reusability. If there is a need to return the same data for multiple applications/components, this may be a better choice instead of repeating the SQL statements.
3). Reduces calls between client and database server.
I am not sure about other databases but you can create stored procedures in host languages in db2 on mainframe which makes them very powerful.
Answer: Foot firmly in the "Stored Procs are bad for CRUD/business logic use" camp. I understand the need in reporting, data import, etc
Write up here...
Answer: Programmers want the code in their app.  DBA's want it in the database.
If you have both, you can divide the work between the two by using stored procedures and the programmers don't have to worry about how all those tables join together etc. (Sorry, I know you want to be in control of everything.).
We have a 3rd party application that allows custom reports to be created on a View or Stored Procedure in the database. If I put all of my logic in the code in another application, I could not reuse it. If you are in a situation where you write all of the apps using the database, this isn't a problem.
Answer: Stored procedures can go out of sync between database and source control system more easily than code.  The application code can too, but it's less likely when you have continuous integration.
Database being what it is, people inevitably make changes to production databases, just to get out of the woods for the moment.  Then forget to sync it across the environments and source control system.  Sooner or later, production db becomes the de facto record rather than the source control system - you get into a situation where you cannot remove any sprocs, because you don't know whether it's being used.
A good process should only allow changes to the production only through proper channels, so that you should be able to rebuild a database from scratch from the source control system (sans data).  But I'm just saying just because it can be done and does get done - changes are made to production database at the heat of moment, between calls from yelling clients, managers breathing down your neck, etc.
Running ad-hoc queries is awkward with stored procedures - it's easier done with dynamic sql (or ORM), which may be the biggest drawback to using stored procedures for myself.
Stored procedures, on the other hand is nice in situations where you make a change but doesn't require re-deployment of app code.  It also allows you to shape your data before sending it over the network where sql in code might have to make multiple calls to retrieve than shape it (although there are now ways to run multiple sql statements and return multiple result sets in a single "call", as in MARS in ADO.NET), resulting in probably more data travelling through your network.
I don't buy any other arguments regarding performance and security though.  Either can be good or bad, and equally controlled.
Comment: Why isn't your stored procedure in source control? Why don't you have unit tests for your database? In other words, why is your database not part of your CI environment?
Answer: Your programming language and application framework are likely:

high-level, especially as compared with SQL
easy to version and deploy via automated processes, especially as compared with SQL

If these two conditions are two, then skip the stored procedures.
Answer: The biggest advantage of sproc in the place I work is that we have way less code to port to VB.NET (from VB6) when time comes. And it's WAY less code because we use sprocs for all our queries.
Also it helps a lot when we need to update the queries instead of updating the VB code, re-compile and re-install it on all computers.
Answer: For Microsoft SQL Server you should use stored procedures wherever possible to assist with execution plan caching and reuse. Why do you want to optimise plan re-use? Because the generation of execution plans is fairly expensive to do.
Although the caching and reuse of execution plans for ad-hoc queries has improved significantly in later editions of SQL server (especially 2005 and 2008) there are still far fewer issues with plan reuse when dealing with stored procedures than there are for ad-hoc queries. For example, SQL server will only re-use an execution plan if the plan text matches exactly - right down to comments and white space, for example, if each of the following lines of SQL were to be executed independently, none of them would use the same execution plan:
<code>SELECT MyColumn FROM MyTable WHERE id = @id
select MyColumn from MyTable WHERE id = @id
SELECT MyColumn  FROM MyTable WHERE id = @id
SELECT MyColumn FROM MyTable WHERE id = @id -- "some comment"
SELECT MyColumn FROM MyTable WHERE id = @id -- "some other comment"
</code>
On top of this, if you don't explicitly specify the types of your parameters then there is a good chance that SQL Server might get it wrong, for example if you executed the above query with the input 4, then SQL Server will parametrise the query with @id as a SMALLINT (or possibly a TINYINT), and so if you then execute the same query with an @id of say 4000, SQL Server will parametrise it as an INT, and wont reuse the same cache.
I think there are also some other issues, and in honesty most of them can probably be worked around - especially with later editions of SQL Server, but stored procedures generally offer you more control.


BCH ABC testnet Faucet?

Question: I want a bitcoin cash ABC chain (BCHABC) testnet faucet.
Cause 15th Nov. onwards after a hard fork on bitcoin cash network existing bch faucets are not working. Even questions over here are also not upto the mark https://github.com/Bitcoin-ABC/bitcoin-abc/issues?utf8=%E2%9C%93&q=faucet
Answer: It is started working now.
I guess after stabilizing ABC chain it is started working as expected tried with https://testnet.wormhole.cash/faucet/
https://coinfaucet.eu/en/bch-testnet/
Thanks.
Answer: Presumably, this is a faucet that's up these days: https://faucet.fabien.cash/
At least the only testnet explorer for ABC that I've found so far is https://texplorer.bitcoinabc.org/ (data for mainnet seems to be the same as other explorers show: https://blockchair.com/ecash , https://ecashexplorer.com). But I can't fully confirm it's working correctly since I haven't found yet how to generate address from mnemonic for XEC (haven't found derivation path yet) and can't really test it (and testnet explorer doesn't show many addresses: all the latest txs are sending from address A to address B which both don't work with the faucet until waiting for 24 hours).

BCH ABC testnet Faucet?


A Riddle - Mountains and Valleys

Question:
Mountains and Valleys, over and under
  Be careful you do not tear it asunder
Boats and planes, birds and flowers
  Create almost anything with this power
What could it be? You'll have to guess
  I hope you don't fold under the stress.
Answer: Answer:

 Origami

Reasoning:

 Mountains and valleys are different types of creases.  When you crease too hard, it becomes easy to rip.  You can create many shapes with folding paper.  "Don't fold under the stress" implies folding.
Comment: Ah! Just beat me to it.
Comment: well done getting the answer, and explaining each line too! The second stanza was meant to contrast how many different kinds of 'paper folding' fall under the umbrella of origami, from paper boats and paper airplanes to more traditional designs like flowers and cranes. 'fold under the stress' was maybe a bit of a giveaway, but too good of a phrase not to use!

A Riddle - Mountains and Valleys


Why after a website password reset am I asked to login again?

Question: I have noticed that every web site has the exact same behavior for their password reset pages. They send a link to your email using which you can reach the password reset page. On that page you enter the new password. So far so good. But at this point, they always prompt me to login again. Why? I just entered my password twice along with my login (email - of course this is done implicitly via the link). So why prompt me to login again? Is there a security reason for this that I am not seeing? Or is it just an old practice that seems to linger?
Answer: There is no reason this cannot be done technically, and I see the occasional site doing it. But it would require extra code to be built, so it's cheaper to let you handle the login ;-)
The same thing happens with the confirmation link when registering: in most cases you still have to login (but in this case there are relatively more sites that auto-login, in my experience).
Comment: The confirmation link is a very different story. If a person only knows the confirmation token but not the password, you certainly do *not* want to give them access to the account. They could have gotten the token through social engineering, intercepting this one e-mail or whatever. This is not sufficient proof of ownership.
Comment: It annoys me too - it's just lazy practice. It's also sometimes indicative of an unstructured application as it suggests it's not easy to trigger a login from a page other than the login page perhaps due to poor code encapsulation / re-use. But most often just lazy...
Answer: This behaviour does indicate one good security practice: all sessions are invalidated on change password.
Perhaps the user is changing password because the old one has been compromised. In that case, invalidating all sessions helps protect the user.
It is true that there is no real need to invalidate the session that performed the password reset. But a website requiring a re-login tends to imply they are following good security practice, while websites that do not do this tend not to invalidate sessions at all.
Comment: I don't entirely agree, good practice would be to end old session and create a new one for the user...it suggests to me the application code is not structured in a way that easily allows this.
Comment: @AndyBoura - yes, that is the best approach. However, it is not the most common approach.
Comment: The question has nothing to do with whether or not old sessions are invalidated. The OP wanted to know why some applications don't automatically start a *new* session after the password has been changed. Session invalidation is another story.
Comment: @Fleche - the question does not mention a new session. He wanted to know if there was a security reason the logout happens and I explained it. We all know the app can be designed not to do this, but as the OP says, many are not. Not impressed that you and Andy are laying into me for answering the question, but I'm learning not to expect anything else from the SE community.
Comment: Not sure what you're reading into the question. The OP didn't say anything about being logged out. He asked why he has to enter the password again into the log-in form when he has just entered it into the password reset form. He may or may not have had an old session which was terminated in the procedure, but that's simply not the question. In fact, it seems a bit odd to forget the password *while* you're logged in (which is not to say that it doesn't happen).
Comment: +1 for the case " the old password has been compromised "
Answer: Possibly the reason is that by logging-in the user as part of the password reset process, you create a new security surface, that you have to audit - in addition to "standard login" and "password reset" you now also have "login while resetting password".
By forcing the user to go through the standard login process, you eliminate that issue, by always doing the login the same way at the same place.
(Yeah, programmer's laziness is a big part of that, too :-))
Answer: I'm not 100% sure, but, after you clicked that password reset link, of course your password is changed, which means you cannot login with that credentials that have been provided with that link or password whatever it was. The credentials which had been logged you into that website somehow are expired. And after you successfully change your password, you can login with full privileges of your account/ profile. Just my opinion,though
Answer: There's absolutely no security reason for forcing the user to enter the password again after they've just changed it. Whoever set the password knows it now, so you might as well log them in.
I suspect plain laziness or ignorance: Adding an automatic log-in requires the programmer to actually think about the problem and write extra code. It's easier to just do the minimum (changing the password) and leave everything else to the standard log-in page.


Is doing something for people's reaction haram?

Question: I actually got new glasses and i am actually gonna wear it to my class tomorrow and i want to see how people will react but is this haram? Like after going i have to wear it to see, so if i wear it while entering to see people's reaction haram? If it is, how should I wear because I just think I may for some reason do showoff, should I just let them see it or should I go to them and say I got glasses but I think I might showoff?
Answer: The showing off that is haram is when someone pretends he is better than other people or when he does acts of worship supposed to be for Allah for the sake of other people seeing.
Example of the first: Someone wears fancy clothes because he thinks other people are less than him.
Example of the second: Someone prays a prayer because he wants to make someone else think he is pious.
Showing people other things is not Haram. This situation you have mentioned has no element of Haram in sight.


Adjective after the preposition "beyond"

Question: How would you parse or diagram "This is beyond sad"? My best guess is that the prepositional phrase is elliptical, omitting the true object (necessarily a noun), such as "something," as in "This is beyond (something) sad." I think this analysis preserves the meaning of the sentence and accounts for the accepted functions of nouns to serve as objects and of adjectives to modify nouns. Thanks for your insights.
Comment: One could argue for isoformalism with 'This is almost intolerable' where traditionally the adjective-modifier is lumped in the adverb class. However, I'd probably prefer the deletion from 'This is beyond being sad'. Perhaps the expression 'beyond Adj' is best regarded as an idiom. Period.
Comment: I would also suggest that 'beyond' requires a participle after it before the adjective. '... beyond being sad ...' To miss out the participle is valid omission, colloquially, but it is still omission.
Comment: How can "almost intolerable" be anything other than an adjective preceded by an adverb?
Answer: This use of "beyond" is metaphorical. It suggests that there is a range of possible emotions about the situation, "sad" is the most extreme one that has a name, but the actual emotion is even further in that direction. Another way to say it is "This is more than sad".

The death of a single person is sad. The death of an entire family is beyond sad.
Comment: Why not? A preposition that refers to a relative locations is metaphorical when used with things that don't have physical locations.
Comment: Because you can't separate beyond from the phrase "beyond [being] sad", which is just a description of an emotion but not a metaphor.
Comment: I don't think prepositions can be metaphorical...


Are hands rendered tumah if water flowed down after second or third pour?

Question: When performing morning netilat yadayim, are the hands rendered tumah if during the second or third pour the water is poured above the wrists?
Comment: Why would they? The reason for 3 pours in the morning is because the ruach ra only goes away after 3. By netilas yadayim for bread the second one is to wash away the first one that is tammeh but not in the morning
Answer: According to the Chayei Adam, the tumah of the morning only applies to the fingers (C.A. 2:1) so water originating above that point won't bring tumah down to the fingers.


The complement of a particular language

Question: We know that Linear context-free languages are not closed under complement, so I encountered a challenge in finding an example to show the above theorem. I think the complement of $L={a^nb^n}$ is not linear, but I can't prove it.
Comment: @HendrikJan That's a really nice example.

Maybe a good heuristic is to look out for context-sensitive languages that can be written as
$L = \{x \in L' : \varphi_1(x) \land \varphi_2(x) \land ... \land \varphi_n(x)\}$,
and to hope that the summands of $\overline{L} = \overline{L'} \cup \Big(\bigcup_i \{x \in L : \neg \varphi_i(x)\}\Big)$ turn out to be linear.
Both languages fit that scheme.
Comment: Indeed, it is a good challenge to find an example of a linear language, who's complement is not linear. The formulation in [Wikipedia](https://en.wikipedia.org/wiki/Linear_grammar#Negative_cases) if quite indirect.
Comment: Hey, I think I might have found a valid counterexample.
I've added it to my answer, so please have a look :]
Comment: @Knogger Yep. Seems to work. Also the complement of $\{a^nb^nc^n\mid n\ge 0\}$, which is of the same "style" as the language in the question.
Answer: The complement of the language $L = \{a^nb^n : n \in \mathbb{N}\}$ should actually be linear, if I'm not mistaken.
Take some string $x \notin L$ over the alphabet $\Sigma = \{a, b\}$, since $L \subseteq a^*b^*$ one of three cases must be true:

$x \notin a^*b^*$, or
$x = a^nb^m \in a^*b^*$ and $n > m$, or
$x = a^nb^m \in a^*b^*$ and $n < m$.

So the complement of $L$ (relative to $\Sigma$) can be expressed as
$$\overline{L} = \overline{a^*b^*} \cup \{a^nb^m : n > m\} \cup \{a^nb^m : n < m\}.$$
Now, $\overline{a^*b^*} \in \texttt{REG}$ so $\overline{a^*b^*}$ must be linear.
Using an induction argument over the rules of the linear grammar $G$ with rules
$$S \to aS | aA$$
$$A \to aAb | \varepsilon$$
and start variable $S$, it can be shown that $L(G) = \{a^nb^m : n > m\}$ is linear. Similarly, $\{a^nb^m : n < m\}$ can be generated by a linear grammar with rules
$$S \to Sb | Bb$$
$$B \to aBb | \varepsilon.$$
Since $\overline{L}$ can be written as the union of linear languages, and the linear languages are closed under union, it follows that $\overline{L}$ must be linear as well.
Counterexample
I think I might've found a valid counterexample.
The language $L = \{a^nb^mc^k : n \neq m \land m \neq k\}$ is well known to be context-sensitive.
Observe that
$$\overline{L} = \overline{a^*b^*c^*} \cup \{a^nb^mc^k : n = m\} \cup \{a^nb^mc^k : m = k\}.$$
It can be verified that the linear Grammars
$$S \to Sc | A$$
$$A \to aAb | \varepsilon$$
and
$$S \to aS | A$$
$$A \to bAc | \varepsilon$$
with start variable $S$ generate $\{a^nb^mc^k : n = m\}$ and $\{a^nb^mc^k : m = k\}$ respectively, and that $\overline{a^*b^*c^*} \in \texttt{REG}$.
So $\overline{L}$ is linear whilst $\overline{\overline{L}} = L$ is not, counterexample ↯

The complement of a particular language


Does using Apache/nginx actually improve security of a webapp?

Question: Let's say there is a webapp where users can upload files with sensitive data and view analytics generated by the backend. Does using a reverse proxy like nginx or Apache actually help with the security of the website? I have seen this claim, but I can't see a reason why this (functionality beyond load balancing) would be the case.
Comment: Compare this to a web server software that you would have done yourself. A combo of well known, comunity maintened, industry tested server software is better. They have fewer errors and  faster patching capabilities. This is going to reduce the potencial attack surface. Also  it will generate a faster incident response.

But it dosen't mean that your ops will configure and secure them.
Answer: Just putting a simple load balancing reverse proxy in front of a broken web application does not fix it. It will implicitly some kind of sanitize HTTP requests at the protocol level, but it will not protect against any  security issues at the web application level, like SQL injection, local file inclusion etc. It will also not protect against uploading malicious files.
Note though that are reverse proxies which can actually help. A Web Application Firewall (WAF) is usually a reverse proxy too. Common reverse proxies like nginx or Apache can be extended with functionality to filter traffic and even add WAF functionality. But this is functionality which needs to be explicitly added or configured.
Comment: So nginx/Apache are useful for certain types of security, namely: 1. protocol-level HTTP request cleaning and 2. as a starting point to configure various firewalls/traffic filtering. Do you have an example/definition of protocol-level HTTP request attacks? I've only heard of app-level issues like SQL injection.
Comment: @BigMistake:  Attacks at the protocol level are for example DoS by slowly sending the header, which can be handled by something like nginx usually better because of a lower overhead per connection. This can be attacks like HTTP request smuggling which most servers don't protect from that much though. It might be just sending unexpected garbage against the server, very large HTTP headers, ...  which might be a problem for a HTTP stack which is not designed for robustness but just makes assumptions about the protocol which are not guaranteed with a malicious sender.


Where can I find Rock Band instruments for Wii

Question: I've been searching for Rock Band instruments for the Wii and I cant seem to find anything. It seems that they aren't carried in stores any more and they only place i can find them is private sales on Ebay. Can anyone tell me where i can find instruments? Or does anyone know if more instruments will be released?
Answer: Have you looked on Amazon?  They seem to have plenty of listings for guitars, keyboards, microphones and drums for the Wii.
Comment: I _have_ looked at Amazon, just now, and it's kind of a confusing mess. It appears to be mostly third-party addons and replacements — no obvious "here's the basic stuff".


How to decompile to java files intellij idea

Question: IDEA has a great built-in feature - decompiler. It works great.I can copy source code, but I cannot find option to extract all decompiled java classes to java files.
This project has a lot of java classes and packages, so I will be to long to copy this manually.
Does anyone know how to extract to java source files.
  Thx
Comment: [Look Inside Compiled Code with Java Bytecode Decompiler](https://blog.jetbrains.com/idea/2020/03/java-bytecode-decompiler/) -- This page introduced the plugin `Java Bytecode Decompiler` in 2020.03. By using this bundled plugin inside Intellij, it's pretty easy to decompile `.jar` to java code.
Answer: As of August 2017 and IntelliJ V2017.2, the accepted answer does not seem to be entirely accurate anymore: there is no fernflower.jar to use.
The jar file is called java-decompiler.jar and does not include a main manifest... Instead you can use the following command (from a Mac install):
java -cp "/Applications/IntelliJ IDEA.app/Contents/plugins/java-decompiler/lib/java-decompiler.jar" org.jetbrains.java.decompiler.main.decompiler.ConsoleDecompiler

(you will get the wrong Usage command, but it does work).
Comment: Merging this answer with the top comment from the accepted answer, the command to launch to use the same params that IDEA uses by default is `java -cp "/Applications/IntelliJ IDEA.app/Contents/plugins/java-decompiler/lib/java-decompiler.jar" org.jetbrains.java.decompiler.main.decompiler.ConsoleDecompiler -hdc=0 -dgs=1 -rsy=1 -rbr=1 -lit=1 -nls=1 -mpm=60 /absolute/path/to/src1 /absolute/path/to/src2 /absolute/path/to/dst`
Comment: Windows **decompile.cmd** scr1 src2 dst: `java -cp "%ProgramFiles%\JetBrains\IntelliJ IDEA 2018.3\plugins\java-decompiler\lib\java-decompiler.jar" org.jetbrains.java.decompiler.main.decompiler.ConsoleDecompiler -hdc=0 -dgs=1 -rsy=1 -rbr=1 -lit=1 -nls=1 -mpm=60 %*`
Comment: On Arch install: java -cp "/usr/share/idea/plugins/java-decompiler/lib/java-decompiler.jar" org.jetbrains.java.decompiler.main.decompiler.ConsoleDecompiler -hdc=0 -dgs=1 -rsy=1 -rbr=1 -lit=1 -nls=1 -mpm=60 /absolute/path/to/src1 /absolute/path/to/src2 /absolute/path/to/dst
Comment: This more brief command worked for me (based on these answers and the usage note): java -cp /java-decompiler/lib/java-decompiler.jar org.jetbrains.java.decompiler.main.decompiler.ConsoleDecompiler -dgs=true
Comment: how could you read what intellij is using as params? i didn't find these info here https://github.com/JetBrains/intellij-community/tree/master/plugins/java-decompiler/engine
Comment: @ahmed_khan_89 by decompiling the decompiler bruh
Answer: Follow instructions for IntelliJ JD plugin. Or see an excerpt from the instructions below.
java -jar fernflower.jar [<source>]+ <destination>

+ means 1 or more times
<source>: file or directory with files to be decompiled. Directories are recursively scanned. Allowed file extensions are class, zip and jar.
<destination>: destination directory

Example:
java -jar fernflower.jar -hdc=0 -dgs=1 -rsy=1 -lit=1 c:\Temp\binary\ -e=c:\Java\rt.jar c:\Temp\source\

Be aware that if you pass it a ".jar" file for the source, it will create another ".jar" file in the destination, however, within the new ".jar" file, the files will be .java instead of .class files (it doesn't explode the jar).

UPDATE
People ask me: How do I get the fernflower.jar?
If you have any IntelliJ product installed, chances are that you already have the Fernflower decompiler on your computer. IntelliJ IDEA comes with Java Bytecode Decompiler plugin (bundled) which is a modern extension of Fernflower.

Locate the file in ${IntelliJ_INSTALL_DIR}\plugins\java-decompiler\lib\java-decompiler.jar (example: C:\Program Files\JetBrains\IntelliJ IDEA 2018\plugins\java-decompiler\lib).
Copy it somewhere and rename to fernflower.jar (optional).
This JAR is not executable, so we can't run it using java -jar. However something like this works:
java -cp fernflower.jar org.jetbrains.java.decompiler.main.decompiler.ConsoleDecompiler [<source>]+ <destination>

org.jetbrains.java.decompiler.main.decompiler.ConsoleDecompiler is the class that contains the main method to run the decompiler.
Example:
mkdir output_src
java -cp fernflower.jar org.jetbrains.java.decompiler.main.decompiler.ConsoleDecompiler -hdc=0 -dgs=1 -rsy=1 -lit=1 ./input.jar ./output_src

If you don't have IntelliJ products installed, either download it now (available on jetbrains.com) or make your own decompiler executable from sources (available on Github).
Comment: Note that this produces sources JARs which would then have to be unpacked to view the decompiled Java files. You can unpack them with a one liner in bash `find ./yoursourcesdirectory -name '*.jar' -exec sh -c 'unzip -d "${1%.*}" "$1"' _ {} \;`
Comment: How do I get the fernflower.jar ?
Comment: @naXa: Really? Like how many actually useful .jars did turn up, when googleing? Not so many, actually...
Comment: @Make42 I didn't get it. Well, fernflower is an open source project. It means everyone can package a jar for himself.
Comment: I did install the plugin, but I cannot find anything...
Comment: @Madeo where did you look?
Comment: in the plugins folder of Intellij, but it's ok, I have used JDGUI.
Comment: Quick answer: Get the complied code that uses Java 17 here: https://github.com/Vineflower/vineflower/releases.  Use command: java -jar vineflower.jar -dgs=1 c:\Temp\binary\library.jar c:\Temp\souce
Answer:
Open an existing project or create a new one.

Go to Project structure settings > Libraries. Add the jar you want to decompile in libraries by clicking the + symbol.

Go to the Project tool window shown on the left. Search for jar name that you added in the previous step. Navigate to the desired class or package.

You can see the decompiled java files for that jar.
Comment: surprised this doesn't have even more votes because this is probably what most people actually are looking to do.
Comment: Downvoted - doesn't answer the question of getting to source files. @NicholasDiPiazza Not necessarily -- it only allows you to browse and only one file at a time. To get source, you would have to copy/paste from the editor window into a new .java file. Not fun when you have 50 or 100 class files you need the source for.
Comment: Works thanks! Now how do I make it editable or move it to my actual intelliJ workspace?
Comment: you can right-click on jar file and choose the option "Add as Library..." - then IDE will allow to browse its content
Comment: strange, I did that with a Minecraft mod jar I want to examine (deobfuscated, of course) and there is no button to expand and explore the jar?
Comment: it is in my libraries, but I'm not able to get the classes even, not the source code...
Answer: You could use one of these (you can both use them online or download them, there is some info about each of them) :
http://www.javadecompilers.com/
The one IntelliJ IDEA uses is fernflower, but it can't handle recent things - like String/Enum switches, generics (didn't test this one personally, only read about it), ...
I just tried cfr from the above website and the result was the same as with the built-in decompiler (except for the Enum switch I had in my class).
Answer: The decompiler of IntelliJ IDEA was not built with this kind of usage in mind. It is only meant to help programmers peek at the bytecode of the java classes that they are developing. For decompiling lots of class files of which you do not have source code, you will need some other java decompiler, which is specialized for this job, and most likely runs standalone, like jad, fernflower, etc.
Comment: but I have copied manually code and it works. Maybe there is any way to do this automaticly or write script to copy from decompiled archive to the project
Comment: See my 2022 UPDATE answer.
Answer: Try
https://github.com/fesh0r/fernflower
Command :
java -jar fernflower.jar -hes=0 -hdc=0 C:\binary  C:\source

Place your jar file in folder C:\binary and source will be extracted and packed in a jar inside C:\source.
Enjoy!
Comment: jar url says not found
Comment: although i could not download the jar from the given link, i was able to follow the usage instructions here to help solve my problem.

i was able to get+use the JAR from my intellij installation. `C:\Program Files (x86)\JetBrains\IntelliJ IDEA Community Edition 2023.1.5\plugins\java-decompiler\lib\java-decompiler.jar`
Answer: Some time ago I used JAD (JAva Decompiler) to achieve this - I do not think IntelliJ's decompiler was incorporated with exporting in mind. It is more of a tool to help look through classes where sources are not available.
JAD is still available for download, but I do not think anyone maintains it anymore: http://varaneckas.com/jad/
There were numerous plugins for it, namely Jadclipse (you guessed it, a way to use JAD in Eclipse - see decompiled classes where code is not available :)).
Comment: Intellij decompiler works great in comparison with other tools, but sometimes it cannot decompile lamdas, so it lefts invokedynamic, but I have tried cfr , and it does it well, but other code not as good as intellij , so I have to copy all code manually (
Answer: I use JD-GUI for extract all decompiled java classes to java files.
Comment: Doesn't install on linux
Comment: Doesn't say how to do it in intellij.
Answer: Someone had gave good answers. I made another instruction clue step by step.
First, open your studio and search. You can find the decompier is Fernflower.

Second, we can find it in the plugins directory.
/Applications/Android Studio.app/Contents/plugins/java-decompiler/lib/java-decompiler.jar

Third, run it, you will get the usage
java -cp "/Applications/Android Studio.app/Contents/plugins/java-decompiler/lib/java-decompiler.jar" org.jetbrains.java.decompiler.main.decompiler.ConsoleDecompiler

Usage: java -jar fernflower.jar [-<option>=<value>]* [<source>]+ <destination>
Example: java -jar fernflower.jar -dgs=true c:\my\source\ c:\my.jar d:\decompiled\

Finally, The studio's nest options for decompiler list as follows according IdeaDecompiler.kt
-hdc=0  -dgs=1  -rsy=1 -rbr=1  -lit=1  -nls=1 -mpm=60 -lac=1
IFernflowerPreferences.HIDE_DEFAULT_CONSTRUCTOR to "0",
        IFernflowerPreferences.DECOMPILE_GENERIC_SIGNATURES to "1",
        IFernflowerPreferences.REMOVE_SYNTHETIC to "1",
        IFernflowerPreferences.REMOVE_BRIDGE to "1",
        IFernflowerPreferences.LITERALS_AS_IS to "1",
        IFernflowerPreferences.NEW_LINE_SEPARATOR to "1",
        **IFernflowerPreferences.BANNER to BANNER,**
        IFernflowerPreferences.MAX_PROCESSING_METHOD to 60,
        **IFernflowerPreferences.INDENT_STRING to indent,**
        **IFernflowerPreferences.IGNORE_INVALID_BYTECODE to "1",**
        IFernflowerPreferences.VERIFY_ANONYMOUS_CLASSES to "1",
         **IFernflowerPreferences.UNIT_TEST_MODE to if (ApplicationManager.getApplication().isUnitTestMode) "1" else "0")**

I cant find the sutialbe option for the asterisk items.
Hope these steps will make the question clear.
Answer: 2022 UPDATE
Like any experienced developer who's being honest, I have to admit it -- I'm lazy. More is less and less is better when it comes to typing. The answers from @naXa and @yan are fine, except for having to open a terminal and type :-(
To decompile a jar right from within intellij, create a reusable JAR Application run configuration:

Copy java-decompiler.jar to a folder in your project (I used lib). Get from:: Windows: C:\Program Files\Intellij\plugins\java-decompiler\lib; or from github (documentation is here)
Copy source jar or class files to same folder
Create a run configuration with settings like these:

Path to JAR: browse to java-decompiler.jar
Program arguments: -hdc=0 -dgs=1 -rsy=1 -lit=1 your.jar lib
Working directory: lib
JRE: 11

In this case, your.jar is the source and lib is the output directory. Save it, run it, and watch it do its thing :-)
Need to do it again with different class files or jars? Duplicate the run config and update Program arguments.
Comment: Quick vineflower answer: Get the complied code that uses Java 17 here: https://github.com/Vineflower/vineflower/releases.  Use command: java -jar vineflower.jar -dgs=1 c:\Temp\binary\library.jar c:\Temp\souce
Comment: @DaveAnkin Updated answer with two locations.
Comment: Where does this java-decompiler.jar come from?
Answer: ---- package jar (java) jar -cvfM0 test.jar

---Decompile jar(class)>>>>>>>>>jar(java) java -cp "C:\Program Files\JetBrains\IntelliJ IDEA 2020.1\plugins\java-decompiler\lib\java-decompiler.jar" org.jetbrains.java.decompiler.main.decompiler.ConsoleDecompiler -dgs=true C:\ Users\luo\Desktop\sf1\pxks\test.jar C:\Users\luo\Desktop\sf1

Unzip manually
Or use the following command to decompress
find the path
cd..
decompress
jar -xvf test.jar
Reference http://t.csdn.cn/3YLK4
Comment: As it's currently written, your answer is unclear. Please [edit] to add additional details that will help others understand how this addresses the question asked. You can find more information on how to write good answers [in the help center](/help/how-to-answer).


R and Rstudio on Apple silicon

Question: has anyone got some info about future roadmap for R and Rstudio in order to support new ARM architecture?
I know that probably we should rely on rosetta2 but I'm just wondering if we will be able to run native code.
Comment: See the link here: https://chat.stackoverflow.com/transcript/message/50912431#50912431
Answer: Take a look at these links, they are gathering information about M1 compatible software and R and RStudio seem to be running fine under Rosetta2 and the developers are working hard on a native solution.
You can also follow this blog.
UPDATE!
Here are some benchmark results leman and I just did.
R under Rosetta2 (M1) is basically 70% faster on average then on my 2.3GHz i5 16GB RAM late 2017 MBPro.
Answer: RStudio is written in a mix of languages, that annoyingly includes some FORTRAN 90.
The issue being there isn't a native, stable, open source, Apple Silicon compiler for FORTRAN 90, though there are commercial compilers, sold by NAG and ARM. There is an ancient, and free GNU tool, f2c, that converts FORTRAN source to C, but it only supports the FORTRAN 66 and 77 standards.
So either:
The like of GNU's f2c need to be tweaked to support the FORTRAN 90 standard, by adding some non trivial logic to handle the intrinsics added between the 77 and 90 standards, the other changes are relatively trivial. Followed by a tweak to the dependency list for Apple silicon builds of RStudio, to convert the offending modules to C, before natively compiling.
Some effort is made into porting the GNU Fortran compiler, gfortran, to Apple's take on ARM's  architecture (proposed for the summer 2022, GNU Compiler Collection, v12.#, though experimental support is available in a V11 fork). With the package natively compiled soon after.
Someone with a commercial, Apple Silicon, Fortran 90 compiler, volunteers to periodically build, run the test suite, sign and submit universal binaries, for RStudio, to the Apple store.
Alternatively the FORTRAN 90 modules included in RStudio, be hand translated into a language, with a native Apple Silicon compiler, say C or C++.
At a push, Apple elects to write and maintain their own FORTRAN 90, 95, 2003, 2008, 2018 compiler, for the architecture (or buys the right for a compiler from ARM or NAG).

R and Rstudio on Apple silicon


Cutting around obstacles in fiber cement siding

Question: I'm rebuilding a wall on my workshop.  At the top of the exterior side, I have to fit something around the ends of the rafters above the J-channel at the top of the siding (there's no soffit.)  That involves cutting 1-3/4" wide, 1-2" deep notches every 24".  I have some fiber cement siding left over from another project that I wanted to use (mostly because it's free.)  If I were using wood, I'd just use a jigsaw to cut the notches.  I've seen circular saw blades and pneumatic shears for cutting the siding, but since this is a one-off project, I really don't want to have to buy anything expensive.  How should I do this?
Comment: Carbide or diamond tip blades for your jigsaw would probably work well enough. An inexpensive set is in the $15-20 range.
Answer: Manual fiber cement cutter (possibly hire one),  hacksaw (but it's slow), angle grinder with a diamiond wheel (slow-ish and noisy and dusty) sabre saw (slightly easier than the hacksaw, but the blades you ruin are more expensive)


Can a person see himself being taken into the grave?

Question: I got a WhatsApp message about what a person sees during death and it was written there that a dead man does not realize that he is dead initially. He feels himself dreaming of death, he sees himself weeping, bathed, tied and descended into the Grave. He still feels dreaming when he is hoarded by the ground. He then screams but nobody hears his shout. Sometimes later, when everyone is dispersed and he is left alone under the ground, Allah restores his soul. Are all these I have mentioned true?
Comment: Welcome to Islam SE. Questions are expected to be specific, on topic, and with some research done prior to asking. Please refer to [ask], and take a [tour] in our [help]. Did the message mention any sources or references?
Comment: See: https://www.youtube.com/watch?v=yQ4UTqFkvCM
Comment: No there was nothing mentioned. Thanks for the link. Jazak Allah Khair
Answer: first off, thats one weird WhatsApp message bro. and yes all of this is true from what i know of, except that the SOUL sees this stuff not the actual body. and when you are dead and in the grave, your soul stays there and gets questioned after a little (whos your prophet, whos your God, whats your religon) by the 2 angels of death. thennnnnn your soul gets dealt with and only returns on the day of judgement (unless u were so good ur already in heaven)
i am not a scholar, dont take what ive said to heart, im a sunni muslim and that is what i have heard from reading multiple books by sunni scholars.