Commenting in Drupal hasn't noticeably changed in 15 years. That changes now.
đź•‘Oct 13, 2026 đź–‹John Locke
đź’¬0
Drupal
đź•‘Oct 10, 2026 đź–‹John Locke
đź’¬0
Drupal Meets Matrix part 2: Live Comments with ECA and HTMX
A comment thread in Drupal works totally fine. You fill in a form, click submit, and your comment gets posted. Same way it has for over 20 years.
But if somebody else replies when you're on the page, you don't see anything change, you don't get any notification.
đź•‘Sep 13, 2026 đź–‹John Locke
đź’¬1
Using AI to review AI-Generated code: Astra vs. Opus vs. DeepSeek
Astra built an impressive amount of working code, but missed serious performance problems. DeepSeek found several of them for 22 cents. Opus cost dramatically more and found a substantially different set of problems, especially around UI and accessibility.
đź•‘Aug 31, 2026 đź–‹John Locke
đź’¬0
Drupal Meets Matrix part 1: Setting up Matrix API
I've been maintaining the matrix_api module on Drupal.org since 2016, nearly a decade of it doing one thing well: posting Drupal events into a Matrix room. This year that changed.
đź•‘Aug 01, 2026 đź–‹John Locke
đź’¬0
Zero to new Drupal site in 133 seconds
Gabor asked in Slack about how people contributing to Drupal manage multiple different Drupal versions, and different contributed module branches, when using AI agents:
Case Study
From Drupal 5 to Drupal Canvas: Keeping KSER on the Air Through Two Decades of the Web
KSER is a community radio station. Community radio doesn’t get downtime — or a huge IT budget.
We started maintaining KSER’s Drupal 5 site in 2013, even though Drupal 5 had already reached end-of-life. For more than a decade, we kept it secure, stable, and useful while the station put its resources where they mattered most.
Now KSER has a new home on Drupal 11 and Drupal CMS, with Drupal Canvas for easier content management and a persistent audio player that keeps the station streaming while visitors move through the site.
Sometimes the right answer isn’t “rebuild now.” It’s maintain what you have well, then replace it when the time is right.
đź•‘Jul 21, 2026 đź–‹John Locke
đź’¬1
We Patched wp2shell in 4 Hours. On a Friday Afternoon.
On July 17, WordPress shipped an emergency security release for a vulnerability chain now being called wp2shell.
đź•‘May 28, 2026 đź–‹John Locke
đź’¬0
Every Night, Argo Watches
While your site is running, things change. A content editor tweaks a configuration setting. A security vulnerability surfaces in a dependency. A production fix gets applied directly instead of going through the normal release process.
đź•‘May 22, 2026 đź–‹John Locke
đź’¬0
The Night the Internet Tried to Kill Your Website
May 2026
My name doesn't matter. Call me the op. I run a small shop — we keep websites alive, patch the holes before the wrong people find them, and make sure that when something goes sideways, there's always a way back. It's not glamorous work. But this spring? This spring was something else.
đź•‘May 19, 2026 đź–‹John Locke
đź’¬0
Your Website Will Be Attacked. Here's How We Make Sure You Survive It.
The question used to be whether your website would face a serious security threat. That question has been answered. The question now is whether you'll be ready when it happens — and whether you can recover cleanly when something gets through.
đź•‘May 18, 2026 đź–‹John Locke
đź’¬0
The Rules Have Changed: Security in the Age of AI-Assisted Attacks
Security is getting dramatically harder and more expensive. AI is simultaneously driving an explosion in vulnerability discovery and weaponizing the exploits that follow. The question for every organization with anything online is no longer whether to invest in resilience — it's whether that investment is already in place before the next incident arrives.
đź•‘Apr 21, 2026 đź–‹John Locke
đź’¬0
When Views meets Drupal Canvas -- getting dynamic content into your Canvas page
From early days, "views" has been the killer feature of Drupal. Views is a powerful querying tool built into Drupal that allows dynamic lists and displays of content to be created without writing custom code.