5 ms·

> Drupal is known for it's large number of community contributed modules that add functionality to the bare bones core system. No, it's known for its ridiculou

by orf 10y ago

> Drupal is known for it's large number of community contributed modules that add functionality to the bare bones core system. No, it's known for its ridiculous number of security issues and sloppy code :/

ksenzee 10y ago
Drupal is easy to criticize, but its handling of security issues and its code quality aren't the two places I'd start. They're actually two of the strengths of the project.
- jacquesm 10y ago
  You're missing a /s there.
  - mschuster91 10y ago
    I've seen worse, way worse, than Drupal Core. That of course does not include Drupal modules - there is, similar to the Wordpress ecosystem, the really bad stuff.
    - jacquesm 10y ago
      But that's the whole problem right there. Such a plug-in architecture with every Tom, Dick & Jane writing modules that are loosely vetted and deployed in the 100's of thousands is broken by design. There is no way a small review team focused on security will be able to audit what 1000's of dedicated lesser gods produce. I can see the advantage of it, you just focus on the core and let the world take care of its own problems but you end up with nearly every site being critically dependent on a couple of obscure modules that will not get the attention they need until it is much too late. This coupled with Drupals nasty habit of obsoleting everything every couple of year (I hear they are changing now) and you're set up for disaster. So even if Drupal Core is not all that bad it is never just Drupal Core.
      - Gaelan 10y ago
        To get a module marked as "covered by the Drupal security team" it is required to go through a community code review.
        jacquesm 10y ago
        Yes, but that's backwards. There are many many modules that don't have that stamp but that are distributed via the site and besides I strongly believe that security is not something you just vet for after the fact but that should go in to the design of your product. If you don't do that it becomes a 'find the last hole in the cheese' exercise and very likely there will be many holes that you don't find that way that would not have been there in the first place had the whole thing been designed from day one with that in mind. On the whole I think 'let amateurs build it and experts vet it' is better than just 'let amateurs build it' but it doesn't come close to 'let experts build it and experts vet it'.
        lightlyused 10y ago
        Which is pretty easy to pass, you just have to follow the coding standards.
        Gaelan 10y ago
        And not have any (glaring) security flaws.
      - heywire 10y ago
        > But that's the whole problem right there. Such a plug-in architecture with every Tom, Dick & Jane writing modules that are loosely vetted and deployed in the 100's of thousands is broken by design. Wait, are you talking about npm or Drupal? (only kind of kidding)
        devwastaken 10y ago
        That actually is a really good point about packages on NPM, or rather the culture of a 'package for everything.'. All it would take is somebody to lose their github account or go rogue, for one popular package that requires their package to also be compromised, and then hundreds to thousands of sites are silently vulnerable. Seriously. A standard ES6 JS project will run you to actual hundreds of packages. Thats a huge attack surface.
devwastaken 10y ago
This can be said of every CMS ever that isn't designed for very specific cases. Many would argue Wordpress is significantly worse and a massive mess. Atleast Drupal 8 tries to standardize and use good standards. If you know a better CMS out there, or any specific current problems with drupal 8, lets hear it.
- mercer 10y ago
  One reason why I prefer Wordpress is that I can pretty much build anything I want with just 'core' and a very small number of plugins (mostly Advanced Custom Fields, which has a paid version and quite actively developed). With Drupal, on the other hand, I've always had to install a whole bunch of contrib modules just to get the basic functionality I needed. Has that changed significantly since Drupal 6 and 7? Am I underestimating how insecure Wordpress core is, even considering that the get the equivalent you'd need Drupal plus a whole bunch of modules?
  - devwastaken 10y ago
    Drupal 8 now has views as a core module, which so far has allowed me to make custom fields for editors and allow them to relate the data entry with other entries or tags/taxomonies. Its the only CMS I've experienced so far that allows me to make data entry highly customized towards the content being added. I'm not sure what you're specifically looking at, but views is pretty much a big abstraction layer for the database, there's a lot you can do with it.
  - lightlyused 10y ago
    You need a whole bunch of wp modules to get to the same level has a Drupal 8 core install.

by orf 10y ago

ksenzee 10y ago

Drupal is easy to criticize, but its handling of security issues and its code quality aren't the two places I'd start. They're actually two of the strengths of the project.

jacquesm 10y ago
You're missing a /s there.
- mschuster91 10y ago
  I've seen worse, way worse, than Drupal Core. That of course does not include Drupal modules - there is, similar to the Wordpress ecosystem, the really bad stuff.
  - jacquesm 10y ago
    But that's the whole problem right there. Such a plug-in architecture with every Tom, Dick & Jane writing modules that are loosely vetted and deployed in the 100's of thousands is broken by design. There is no way a small review team focused on security will be able to audit what 1000's of dedicated lesser gods produce. I can see the advantage of it, you just focus on the core and let the world take care of its own problems but you end up with nearly every site being critically dependent on a couple of obscure modules that will not get the attention they need until it is much too late. This coupled with Drupals nasty habit of obsoleting everything every couple of year (I hear they are changing now) and you're set up for disaster. So even if Drupal Core is not all that bad it is never just Drupal Core.
    - Gaelan 10y ago
      To get a module marked as "covered by the Drupal security team" it is required to go through a community code review.
      - jacquesm 10y ago
        Yes, but that's backwards. There are many many modules that don't have that stamp but that are distributed via the site and besides I strongly believe that security is not something you just vet for after the fact but that should go in to the design of your product. If you don't do that it becomes a 'find the last hole in the cheese' exercise and very likely there will be many holes that you don't find that way that would not have been there in the first place had the whole thing been designed from day one with that in mind. On the whole I think 'let amateurs build it and experts vet it' is better than just 'let amateurs build it' but it doesn't come close to 'let experts build it and experts vet it'.
      - lightlyused 10y ago
        Which is pretty easy to pass, you just have to follow the coding standards.
        Gaelan 10y ago
        And not have any (glaring) security flaws.
    - heywire 10y ago
      > But that's the whole problem right there. Such a plug-in architecture with every Tom, Dick & Jane writing modules that are loosely vetted and deployed in the 100's of thousands is broken by design. Wait, are you talking about npm or Drupal? (only kind of kidding)
      - devwastaken 10y ago
        That actually is a really good point about packages on NPM, or rather the culture of a 'package for everything.'. All it would take is somebody to lose their github account or go rogue, for one popular package that requires their package to also be compromised, and then hundreds to thousands of sites are silently vulnerable. Seriously. A standard ES6 JS project will run you to actual hundreds of packages. Thats a huge attack surface.

devwastaken 10y ago

This can be said of every CMS ever that isn't designed for very specific cases. Many would argue Wordpress is significantly worse and a massive mess. Atleast Drupal 8 tries to standardize and use good standards. If you know a better CMS out there, or any specific current problems with drupal 8, lets hear it.

mercer 10y ago
One reason why I prefer Wordpress is that I can pretty much build anything I want with just 'core' and a very small number of plugins (mostly Advanced Custom Fields, which has a paid version and quite actively developed). With Drupal, on the other hand, I've always had to install a whole bunch of contrib modules just to get the basic functionality I needed. Has that changed significantly since Drupal 6 and 7? Am I underestimating how insecure Wordpress core is, even considering that the get the equivalent you'd need Drupal plus a whole bunch of modules?
- devwastaken 10y ago
  Drupal 8 now has views as a core module, which so far has allowed me to make custom fields for editors and allow them to relate the data entry with other entries or tags/taxomonies. Its the only CMS I've experienced so far that allows me to make data entry highly customized towards the content being added. I'm not sure what you're specifically looking at, but views is pretty much a big abstraction layer for the database, there's a lot you can do with it.
- lightlyused 10y ago
  You need a whole bunch of wp modules to get to the same level has a Drupal 8 core install.