Recent Blog Posts

Greg's picture

Drupal module selection in the enterprise: lists and processes

We are driving ourselves crazy, folks. Choosing modules is really hard. And it's only getting harder on enterprise Drupal sites (and enterprise just means big teams and with big sites with big requirements).

A recent conversation on twitter started by Drupal rock star Katherine Bailey shows how module selection on a big site can drive you crazy:

So, today I'm going to lay out some ideas I've found for reducing the madness: choosing good modules both as an individual and as a member of an enterprise Drupal site. Of course the enterprise practices build on the set of guidelines for an individual site builder. I'd love to get feedback on other techniques people have used for module selection in big team, big site, enterprise environments.

Module selection best practices

  1. First, identify your need and try to be as generic as possible. If you say "Building an event system" you may skew your results toward the Event module when what you really need is some combination of Date, Calendar, Views, and Signup.
  2. Next, search around for modules that match what you need and look for recipes and tips from blogs or groups.drupal.org. This is often where you will find great advice on which is the best module to choose. Try the similar module review group which is an amazing resource.

carl's picture

Code and slides from Drupal theme preprocess functions: an introduction.

I've uploaded my slides and theme directory from my Drupal theme preprocess functions session today at Drupalcon Copenhagen.

If you have any questions, feel free to leave comments below, or please contact me via my drupal.org contact form or find me on IRC or twitter @c4rl.


Greg's picture

Drupal Security Report: Connect with Fans, Reason to Sponsor

Recently our company worked with partners and sponsors to create a thoroughly researched, high quality document about the state of security in the open source Drupal project. You can download the report from DrupalSecurityReport.org, but right now I want to talk about the motivations, the audience, and the funding model behind the report because we feel that we've solved a tricky problem: funding expensive work in an easily copied medium (PDF downloads). We decided to try a variation on Techdirt's strategy to "Connect with Fans and give them a Reason to Buy".

This report was something that my colleague Ben Jeavons and I had wanted to do for a long time, but we couldn't fund it entirely from our own company resources. The target audience for the report is people who are considering Drupal and we didn't feel that they would be willing to spend money purchasing the report.

Connect with Fans

Fortunately, we have built up an audience among people interested in Drupal Security. Last fall I did a security webinar for a few hundred folks leveraging Acquia's webinars. Our blogs are directly read by a few thousand people interested in Drupal and are syndicated to over 20,000 readers readers interested in the topic. We've also done several presentations on Drupal security.

So, with a purpose and some fans in tow, we turned to business contacts we've made over the years to see if they could help with funding.

Reason to Sponsor

Based on discussions with them, our sponsors were motivated to sponsor the report based on three major ideas (and one sub-idea).

  1. They sell Drupal in the enterprise space and are often confronted with questions about security and don't have a good answer. They wanted something they could point to.

Greg's picture

What content is HOT on my site? Drupal's Radioactivity module to the rescue

Earlier this year we supported the IxDA in launching a new version of their IxDA.org site. One of the many interesting new features of this site is the ability to sort content by "hotness". The goal of this tool is to create a list of interesting content on the site. Their analytics show them that most people who are involved in the site visit it at least twice a month. So, they wanted a system to highlight content over the last two to three weeks. Enter the radioactivity module.

Radioactivity Module for Drupal

The Radioactivity module works on the concept of adding energy to a piece of content which then "decays" (or diminishes) with a particular half-life. The exact behavior is up to the site administrator, but on IxDA.org we originally set it up with values roughly similar to:

  • Posting content adds a lot of energy so that the hotness favors recent items.
  • Commenting on a post adds some energy
  • Voting up adds a bit of energy, voting down subtracts some energy
  • Favoriting a post adds some energy as well

We've got a few other elements that affect energy to help offset any potential gaming.

We set the half-life for decay to 15 days. So, if a piece of content gets posted and 3 comments and 2 vote ups and 1 favorite with 100 views on the first day it will have about 500 units of energy. If it gets no new energy, it would decay down to 250 units of energy after 15 days, and then down to 125 after 30 days and so on. Eventually the energy and decay are really small and for efficiency the module simply deletes all records with less than 2 units of energy.

Extending the Radioactivity Module


Ben's picture

Security training and sessions at Drupalcon Copenhagen

Carl, Ezra, Lisa, and I will be at DrupalCon Copenhagen later this month. We're giving a handful of sessions and running a training. So, if you're in Copenhagen on August 23rd and interested in getting security training, for identifying and fixing common security risks on your site, join us! Check out Security: Process, code & hands-on training to signup.

Our Sessions at Drupalcon

Drupal Security Paper update

Last week we published a minor update to the Drupal Security Paper, a report on the state of Drupal security and how it addresses security risks and concerns. We expanded some of the Security Advisory analysis data and made a few minor corrections. If you have not read it, now is a great time to take a few minutes and give it a read.


Greg's picture

Contributors to Drupal.org CVS since 2000

One measure of the momentum of the fine Drupal project is the number of people who are creating contributed modules on drupal.org.

The Drupal contributed projects are stored in a system called CVS and data about that is stored in some database tables that keep track of each change by each person. At the request of some fine folks who are working on important things, I got interested in the idea of the trend related to people committing code to the drupal.org CVS server. Here is the data graphed by the number of committers per month. It is not the number of commits, which would show how active those people are, but the number of people which shows how big of a group of people is doing this work.

Also, this is only about the contributed module and theme area and not about Drupal core. Drupal core commits are done by a very small group of people after that small group reviews the code contributed by hundreds of contributers. So, this really shows activity of the non-core projects.

Contributers to drupal.org contributed module repository

I've labeled 4 points on the graph.

1. 2006 through Drupal 5.0 slump

Point 1 shows a peak at June of 2006 followed by a slow down until the trough at August of 2006 and then some small increases until December of 2006. Then there is a huge increase in people in January and February of 2007 which is also when Drupal 5.0 was released.

2. 2007 Follows a similar contribution trend


Greg's picture

Ubuntu cron Isn't Running? Some things to check:

I had some issues where cron wasn't running the scripts that I had placed into /etc/cron.hourly nor /etc/cron.daily and I spent a bit of time trying out different things to figure out how to fix it. Here are some of the things I fixed. I think the problems were, in fact, not all present but several were which meant every time I thought I had it fixed I would come back later and see it was still wasn't running.

An Extension on Your Program Name in /etc/cron.*/

Cron has very specific rules about file names. In fact, those rules are:

same naming convention as used by run-parts(8): they must consist solely of upper- and lower-case letters, digits, underscores, and hyphens.

So, don't put a period nor file "extension" on those files.

Cron Scripts Inherit A Limited Environment

Unless you've added information to the top of your /etc/crontab, the environment for the user that runs cron jobs will be very limited. All commands and shell scripts should be prefixed with the path (i.e. "/usr/bin/mysqldump" instead of "mysqldump"). Specifically state the shell at the top of the file.

Make Sure The Jobs are in /etc/crontab and Cron/Anacron are installed

Just because you're using "Ubuntu" doesn't mean it's the same Ubuntu that you're used to. Make sure that appropriate jobs have been added to the /etc/crontab file. It's possible that cron/anacron won't be installed on the system. If not, try:

sudo apt-get install cron anacron

Make a Basic Script and Check the Cron Log

Depending on your system this may be in different places, but for me it was in /var/log/syslog. If that isn't helpful, try adding debugging statements to different scripts to make sure they are running and test different assumptions along the way. You can also try creating a script that will get executed first ("aaa_test_script" is my favorite) and make it do something really trivial like

echo $PATH > /tmp/cron_path.txt


Ben's picture

Drupal Security Report

Last week at DrupalCon SF we released the Drupal Security White Paper on drupalsecurityreport.org. The paper has been under development for the last several months and we worked hard to complete it in time for DrupalCon.

Addressing ongoing questions about Drupal security, the paper analyzes the Security Team's Security Advisories and discusses how Drupal 6 and 7 address common and critical security risks, including those of the OWASP Top Ten.

We couldn't have done it without the help of our sponsors, including Cydeck and Examiner.com among others, and without the help of our reviewers. Thank you!

If you're evaluating Drupal for use on your site, this report is for you. Or, if you're just curious to know more about Drupal and how it addresses security risks please give it a read.


Greg's picture

Get a Druplicon Hat: CertifiedToRock score of 6 and tweet about it

We've got a few exciting announcements here at Drupalcon. Two of those are related to a new site we launched yesterday, CertifiedToRock.com.

Woven Druplicon Hats

We got some beautiful hand-made, wool Druplicon hats from Peru with the help of my good friend Fernando Garcia (develcuy) and the artisans that his lovely wife Nancy works with. Now we're ready to give these hats away - for free - but of course there's a catch ;)

Webchick and Vauxia in Druplicon hats

Certification for Drupal with CertifiedToRock.com

We've built a super simple (and yet, we think, still valid) certification for Drupal users based on their involvement with the Drupal project. It's located at CertifiedtoRock.com where you can enter a drupal.org username and see the corresponding certification level of that individual. Learn more about CertifiedToRock.

certified to rock screenshot for webchick

If you want a hat, tweet a link to your score with @certifiedtorock and we'll hook you up if your score is 6 or higher. After noon on Wednesday we'll be giving out hats to anyone with a score of 5 or higher.


carl's picture

Files from my DrupalCon San Fransisco session on theme preprocess functions

Attached to this post at the bottom is an archive of the theme I was using including my theme files that I used today in my session on theme preprocess functions.

Don't forget to get the devel module in order to use the function dpm()

For those of you who witnessed the problems I was having today, the reason I couldn't get load the right data was because I was getting a MySQL error because I was trying to push too much information using dpm().

Warning: Got a packet bigger than 'max_allowed_packet' bytes query: ...

This is because I was pushing data into $messages with dpm() in both mytheme_preprocess_node() and mytheme_preprocess_page(). So, when I would load the homepage, I was getting the page $vars and 5 instances of the node $vars! That's a lot of data and I haven't tweaked the MySQL install on my new computer. Anyway, live debugging at it's finest.

If you attended the talk and didn't take the survey, please visit the survey page to do so.

Thanks!


Syndicate content

Featured Team Member

Ezra's passion for technology and music intersect in building sites where online interaction results in real-world meetings, ideally at live musical performances.

Drupalcamp Colorado

We had fun at Drupalcamp Colorado!

Drupalcamp Colorado

We Wrote the Book On Drupal Security:

Cracking Drupal Book Cover

We were at Drupalcon San Francisco

See the videos now: