Drupal

As I mentioned in a previous post, I'm currently playing catch-up in discussing all the good books sent my way this past year. Many of the books have been sent by the authors and publishers themselves for review and some of the books I've bought on my own dime. There should be no further evidence that I'm a procrastinator in posting book reviews than this particular review of Todd Tomlinson and John K. Vandyke's Pro Drupal 7 Development. This book was published almost a year ago, and I'm only now finding the time to blog about this book.

A couple weeks ago, Liferay's marketing and communication folks sent me an email mentioning that Liferay was included as a "Leader" in Gartner's 2011 Magic Quadrant for Horizontal Portals. After my usual procrastination I finally got around to reading the report and what follows in this blog post are some impressions that jumped at me while reading the report. I'm not convinced the randomness of these personal thoughts make up a blog post (at least a well-written blog post) but I'm going for it since my public note taking often turns out better than a well polished article.

A couple weeks ago my family spent some vacation time at Disney World in Orlando, Florida. If you have ever been to a Disney theme park then you know full well that it takes a lot of work in those parks just to have fun. Some of the most popular rides in these parks have waiting periods of up to two hours due to the long lines of people wanting to get on board. Luckily, my wife brought a Disney tourist guidebook that gave our family the helpful hints, recommendations, and information we needed to beat those long lines.  In the end, we ended up with a very enjoyable trip (so enjoyable that we got to ride Space Mountain twice!). That travel guide was a valuable asset to my family's vacation. 

After three years of open source development, Drupal 7 has finally been released to the public. As Ric Shreves previously mentioned in his article, there are literally hundreds of changes in Drupal 7. I've included below a list of the more significant changes from Drupal 6 to Drupal 7. I've also included a nice Drupal 7 marketing video via Jeff Robbins at the bottom of this post. Also there is always official Drupal 7 announcement for additional information on this latest version of Drupal.

Barring any unforseen changes to how I manage this site, I expect we will be upgrading CMSReport.com from Drupal 6 to Drupal 7 within the next few months. I've been playing with Drupal 7 off and on this past year, but I must confess I haven't been as aggressive in my testing of this version of Drupal as I was with Drupal 6.

Some of the more significant changes in Drupal 7 since the release of Drupal 6 include:

1. Overhaul of the User Interface

Work has been done to improve the user experience and administration interface. The new administration theme "Seven", the overlay module, the dashboard and the configurable shortcut bar, all lead to a much more user-friendly interface.

2. Custom Fields

Drupal 7 bundles in the ability to add custom fields, similar in functionality to the Content Construction Kit (CCK) module. However, fields are no longer limited only to content types; they can be added to users, taxonomy terms, and other entities. Fields also have support for translations.

3. Image Handling

Drupal 7 brings native image handling to core. Image fields may be added to content, and have image styles applied to them, such as scaling, cropping, and other effects.

Last week was a very frustrating time for me. For whatever reason, an unusually number of botnets decided to zero in on my Drupal site and created what I call an unintentional  Denial of Service attack (DOS). The attack was actually from spambots looking looking for script vulnerabilities found mainly in older versions of e107 and WordPress. Since the target of these spambots were non-Drupal pages, my Drupal site responded by delivering an unusually large number of "page not found" and "access denied" error pages. Eventually, these requests from a multitude of IPs were too many for my server to handle and for all intents and purposes the botnet attack caused a distributed denial of service that prevented me and my users from accessing the site.

These type of attacks on Drupal sites and numerous other content management systems are nothing new. However, my search at Drupal.org as well as Google didn't really find a solution that completely addressed my problem. Trying to prevent a DDoS attack isn't easy to begin with and at first the answers alluded me.

I originally looked at Drupal for the solution to my problems. While I've used Mollom for months, Mollom is designed to fight off comment spam while the bots attacking my sight were looking for script vulnerabilities that didn't exist. So with Mollom being the wrong tool to fight off this kind of attack, I decided to take a look at the Drupal contributed model Bad Behavior. Bad Behavior is a set of PHP scripts which prevents spambots from accessing your site by analyzing their actual HTTP requests and comparing them to profiles from known spambots then blocks such access and logs their attempts. I actually installed an "unofficial" version of the Bad Behavior module which packages the Bad Behavior 2.1 scripts and utilizes services from Project Honey Pot.

As I had already suspected, looking for Drupal to solve this botnet attack wasn't the answer. Pretty much all Bad Behavior did for me was to take the time Drupal was spending delivering "page not found" error pages and use it to deliver "access denied" error pages. My Drupal site is likely safer with the Bad Behavior module installed, but it was the wrong tool to help me reduce the botnets from overtaxing Drupal running on my server. Ideally, you would like to prevent the attacks ever reaching your server by taking a look at such things as the firewall, router, and switches. However, since I didn't have access to the hardware, I decided it was time to look at my Apache configuration.

Guidelight Business Solutions, a custom software and web strategy company based in Texas, has put together a little video highlighting their experience at last month's DrupalCon in San Francisco. The video does a good job in capturing the fun, scale, and pace of a Drupal conference. At the start of the video, you'll also see a snip of video of me taken during an interview while we were waiting for one of the keynote speakers to come on stage. I'm honored to be included in a video among so many of the other talented faces that were there for DrupalCon.

You can check out the video either below or at the website of Guidelight Business Solutions.

While I was at DrupalCon last week, Chris Pliakas sent a tweet out that he used screenshots from CMS Report in his Apache Lucene presentation. I'm always flattered when this site gets noticed for something we're apparently doing right. In this particular case, we're using the contributed Drupal module Search Lucene API for our search engine as well as for faceted search and content recommendations (recommended links).

If you had talked to me a few years ago, I would have told you that the Search module that comes with the Drupal CMS is all a site like mine needs. After I became a beta tester for the Acquia Network along with their implementation of Apache Solr called Acquia Search, my opinion quickly changed. I'm now convinced that an enterprise quality search engine is truly something that can make or break your website. If you're a smaller Drupal site that feels like Solr or Acquia Search is overkill or not in your cost range, Search Lucene API may be the answer you've been looking for all this time.

The actual name of Chris' DrupalCon presentation is: "Build a Powerful Site Search with the User-Friendly, Easy-to-Install Search Lucene API Module Suite". The video of his presentation can be viewed at Archive.org and has been embedded above. Screenshots from CMSReport.com can be seen in the time frame from 19 minutes to 21 minutes.

I spent Sunday flying to San Francisco for this year's DrupalCon. Attending this Drupal conference is a first for me. For the past few years. I've wanted to attend the conference but either personal or professional distractions came up that prevented me from attending the conference. This year is my year for DrupalCon and I'm anxious to get to know the Drupal community better than I have in the past.

In the world of open source CMS there is no comparison more attention getting than an article comparing Drupal and Joomla!. Probably, the granddaddy Drupal vs Joomla! comparisons of them all was posted over three years ago by the Joomla SEO company, Alledia. I extended the discussion Alledia started with my own comparison between Drupal and Joomla. My article evidently struck a chord in late 2006 and currently is approaching near 200,000 reads.

Good comparisons between Drupal and Joomla! are popular because quality comparisons between the two applications are rare. It's very difficult to have passion for one CMS, be well informed on both CMS, and in the end be non-bias in your comparison. In the three years since I wrote my article, I've only come across three additional comparisons between Drupal and Joomla! that I thought worthy to bookmark.

I haven't updated my own article comparing Drupal and Joomla because I have developed a bias opinion over the years that I can't overcome. Both are good applications in their own right, but in the end I almost always recommend Drupal over Joomla!. That's why I'm glad to see Alledia update their own comparison between these popular CMS with "Joomla and Drupal - Which One is Right for You? Version 2".

Passwords, user accounts, email verification. I have never liked requiring my website's visitors to register before they can leave a comment. There is a large segment of people that like to submit quality comments online, but they don't want to be required to leave their personal information there. So from the beginning, I have always allowed anonymous commenting by unregistered visitors and for the most part, they quality of the comments haven't suffered. However, allowing for anonymous comments also invited my site into a war against comment spam. My latest weapon to do the fighting for me in this war is Mollom.