Business

Why do websites get hacked? Websites get hacked for a bunch of different reasons:

We've had several clients recently chafing at how confining Drupal sites can be -- it can be a lot more work to make individual pages vary from the template, and if you have build web sites using a tool like Dreamweaver, you can't tweak the layout the same way.

We call these hand-built sites brochure, or static, because they are a collection of files you build once, and then don't change very often. Drupal is a Content Management System (CMS), a program that helps you manage content.

So what's the difference? Why would you want Drupal over a static brochure site?

We have several customers interested in adding CRM to their Drupal sites, so today I hopped on a conference call with a working group developing CRM tools for Drupal 7. It's a small group, but it sounds like they are making good progress with the Party module, to serve as glue between all the various items that might end up in your database, to de-duplicate and associate them as a single entity.

The question is, what is CRM, and why build another in Drupal?

Last weekend I had the good fortune of being able to attend TEDxRainer. The event could best be summed up in one word:

Passion.

Everybody there seemed passionate about being there, sharing ideas, looking for ways to make the world a better place. And after spending a solid 10 hours among such passionate, engaged people, it's hard to come away without being inspired.

At Freelock, we're huge fans of Drupal. But we keep running into customers (or potential customers) who are terrified of it. So here's our take on why.

5. I just want a web site! It's too complicated!

Drupal is not just another web site builder. In experienced hands, it's easy for a Drupal developer to spin up a simple web site on Drupal -- I've done it in a matter of a couple hours, complete with initial content. But if you're not experienced with Drupal, the learning curve to get something useful is steep.

A question came across the Drupal Developer's list today asking whether Drupal could auto-update itself, like WordPress. As someone who thinks about security a lot, the very thought of this horrifies me.

It's a bad idea for several reasons, but the biggest reason:

It could easily lead to the biggest most powerful bot-net on the planet.

This could just as easily happen to WordPress, too. It already has, in fact, to a small extent.

That's the essence of a question I got today. And it's not one that can be answered easily, because there's no such thing as a site being "secure." It's not an either/or question, it's really a "how much" type of question. How hot is it today? Let's take a look at the temperature -- hot for you may well be different than hot for me. I'm from Alaska, after all...

Short answer: it depends.

We still do most of our projects in Drupal 6, mainly because it's been around a few years, and modules we use on many sites are not yet stable for Drupal 7 (and some are still a ways off).

However, for sites that don't need particular modules, Drupal 7 at its core is a nice improvement.

My first Drupal 7 site is a personal one, http://www.hikeswithhazel.com. So far as a user, it doesn't seem that different from Drupal 6, especially if you turn off the "Overlay" module which pops open editing screens in what I find to be a highly annoying way.

Here at Freelock, we've been making the transition to using Open Atrium as our project management platform, and thus far I've been quite impressed with it. As good portion of my background has been in organizational and project management and I've had the occasion to acquaint myself with a variety of software tools used in that role, John asked that I weigh in on the program.

All the planning and preparation in the world won't prevent an incident, but it can greatly reduce the consequences.

Nothing better prepares you for responding to disaster than experience. In the world of web applications, sometimes we act as firefighters, coming in to rescue the smoldering remains of a hacked site, a crashed server, or an unexpected traffic burst.