We are almost ready to announce on the blog that we are open sourcing SEDE.

Before we do that I wanted to get a bit of feedback to make sure that what we are doing makes sense and is easy to follow.

Where is the code?

The code is located at: https://github.com/StackExchange/StackExchange.DataExplorer

What can I do to help?

I tried to make it as easy as possible to contribute. To help out with the JavaScript side of things or styling, all you need is a web browser and Git client. To help out with the .NET side of things you will need VS 2010 and SQL Server (Express at least)

I tried to expand on this in the readme.

What is the license?

We have chosen the very liberal MIT license; this means that you can take the code and use it in your own commercial project. Of course you must account for the trade dress side of things, so if you deploy an instance of SEDE we do not want it to look like it's a Stack site.

What kind of contributions are we hoping for?

Some areas that I think could use TLC:

  • We could do a bit better with the awesome SlickGrid (things like sorting, better styling or cut-and-paste support and so on)
  • Graphs would be awesome
  • Bug fixes
  • Stuff that makes SEDE better at teaching and learning

How do I contribute?

Easy! Fork this repository on GitHub; anyone can do that. Commit changes to your fork, preferably in easy-to-merge branches. Submit a pull request on GitHub with a description of your changes.

And now, for the question

What else do you think we need to do before we announce this on the blog?

  • 1
    A brief description about it on the summary page would be nice, too, so that someone who isn't form with SE does know what it is, and how he can use it. – Time Traveling Bobby Jun 21 '10 at 11:40
  • 1
    You probably have a good reason, and VS2010 has been out for a while, but is it using anything not provided by VS2008? – Mark Hurd Jun 21 '10 at 11:48
  • @Mark, yerp its running .Net 4 the latest and greatest from MS, so no VS 2008 as it has no support – waffles Jun 21 '10 at 12:05
  • @waffles, I think he means are you using any .Net 4.0 features? – Earlz Jun 21 '10 at 20:33
  • @Earlz, well not too many 4.0 features are used, but Im not convinced that downgrading to 3.5 would result in more contributors, people in the OS world generally want to use the latest and greatest, its a great place to pick up new technologies and such – waffles Jun 21 '10 at 22:19
  • I know nothing about .NET or C#, but is there any reasonable chance to get this running using Mono and some other database e.g. MySQL? – Juha Syrjälä Jun 23 '10 at 18:14
  • @Juha running this on other databases should be fairly easy, however I am using .Net 4.0 specific features and I am not sure how inline mono is with them. It may be possible to get this working in mono, not sure how much fiddling will be needed. – waffles Jun 24 '10 at 2:32

Well, saving queries and the recent tab is super confusing.

The "What is my reputation's percentile" question had a few views and favorites.

Then, I edited it, and saved it again, and now it looks like I hijacked the query. And, you can't tell who originally wrote the query.

  • 1
    I agree, but perhaps it makes sense to open a separate request on it. I should probably rename "edit" to "clone" when you are editing someone elses query, cause that is what it does – waffles Jun 21 '10 at 21:57
  • fyi I renamed edit to clone if you are cloning stuff ... – waffles Jun 23 '10 at 23:43
  • I note that the original query doesn't appear in the list if you sort queries by favorites... – bdonlan Jun 24 '10 at 3:54

Related to teaching and learning aspect: I dislike how the parametrized queries are implemented using string concatenation. There is a short step from "hey, this is how it is done at SEDE" to sql injection vulnerabilities.

select * from Users where Id = ##UserId##

If you set UserId variable to abc, SEDE will execute this query: select * from Users where Id = abc.

I think that parametrized queries implemented in different fashion.

  • 2
    @Juha, I added support for strongly typed params today, odata.stackexchange.com/stackoverflow/q/5079/… – waffles Jun 24 '10 at 3:02
  • Surely you shouldn't be allowing SQL injection through the parameters in the default configuration? – bdonlan Jun 24 '10 at 3:57
  • I am thinking more like "select foo from tbl where bar = ? and baz = ?" or "select foo from tbl where bar = :var1 and baz = :var2". At least those would work in Java and JDBC. – Juha Syrjälä Jun 25 '10 at 6:58
  • 1
    @bdnolan ... anybody can inject any sql they want, that is the whole point of SEDE and the reason we have a big text box that allows people to enter SQL ... – waffles Jun 25 '10 at 7:12
  • @Juha, if I go with bar = ? how do I know what the name of the param is? if I go with bar = :var1, how do I know what the type is? – waffles Jun 25 '10 at 7:13
  • @waffles, you do not need know the name, 1st. parameter is 1st. parameter. You could try to get type information from database driver, or just plain try and error: there is fixed number of possible types for each variable: string, integer, date, time, timestamp and few others. – Juha Syrjälä Jun 26 '10 at 9:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .