October 27, 2009

Messenger's Error(s): Chris Wilson's flawed rant about Drupal and whitehouse.gov

The White House's official internet home recently refreshed with Drupal as their foundation. Upon hearing the news, I, like so many open-source evangelists, was elated. Big win for Drupal and the open-source community.

As my previous posts allude, I'm a big fan of Drupal. That being said, I have come to terms with the fact that it is flawed. I, like so many others, have blurted expletives at my innocent computer screen on account of Drupal's annoyances. While I wholeheartedly tout its strengths, Drupal does have its weaknesses.

Still, seeing Obama's grinning face and knowing that Drupal was just out of frame providing the foundation -- now that made me happy and proud. But, when I read this article on Slate.com that got me pretty fired up. I'm more of a developer than a writer, and I have a feeling that the article's writer, Chris Wilson, is more of a writer than a developer. Still, his argument does not hold water, and he really should have done his research before writing this (and before linking to my post in it)...

The article's comments (and other reactions on Twitter and elsewhere) pretty much sum it up, but I feel like I need to break this down:

Wilson: Drupal knows best
McNamara: No, Drupal is cautious about which users can do what, and with good reason.

In this section, Wilson claims that Drupal stifles the user's rights with a sort of blind "straitjacketed paternalism", using the ability of a user to post javascript code to the CMS as an example. First of all, a user with sufficient permissions is able to post javascript code (and even PHP code) to the body of a page.

For example, here's some "malicious" javascript I put right in this page: The world is flat!

Drupal limits this level of access with very good reason. Allowing javascript code (not to mention PHP) to be inputted on your site is an invitation for disaster -- in no time flat, someone could really mess up your site.

True, Drupal really sticks to the tenet that "with great power comes great responsibility", but I think this is a great strength of Drupal, not a weakness. Furthermore, this doesn't really apply to whitehouse.gov, which is much less driven by user-contributed content, and much more by people who, well, know what they're doing and need that level of control over the content of their site. They stand to benefit from controlling who has permission to add certain kinds of content, be it html code, javascript code, images, what-have-you.

Wilson: Drupal is impenetrable
McNamara: Yes, Drupal has a steep learning curve, but that has little to do with the front-end usability of whitehouse.gov.

Yes, I agree, Drupal can seem "hostile to newcomers" (though I think you’re putting words in my mouth), but Wilson's analogy that likens Drupal to "bureaucratic sprawl" takes it way too far. In this section, Wilson links to my previous post about Drupal Usability, citing me as one of Drupal's defenders. While I'm flattered, at the same time I am a little miffed because it's clear he either didn't read or understand my post. If he had read it, he would have seen that it was aimed towards those seeking to install Drupal, not front-end users... Drupal was chosen by (smart) people who already know Drupal and have gotten over the learning curve, no matter how steep. They are not newcomers to Drupal.

What really matters in the instance at hand (whitehouse.gov), as far as usability is concerned, is the front-end, not the back-end. The casual visitor to the site has very little interaction with the Drupal application itself. The user-friendliness of a site like this (static, content-driven, running on countless mirrors -- a true server optimizer's wet dream) depends on the work of the front-end designer, not the backend application. Honestly, when it comes to user interface, this site could have been built on SharePoint, and the superficial facade would be practically identical. So, Wilson is misdirecting his critique.

Wilson: Drupal hates change
McNamara: I see where you're going with this, mildly amusing... But, actually, Drupal invites change and thrives on it, like many other open-source projects.

True, it is no small endeavor to upgrade a site between major Drupal releases. This holds true if you are doing upgrades with commercial products and open-source alike, and not just in the Web content management arena. While, with careful project planning and management, upgrade migrations can be executed successfully with minor issues to mitigate. 

Wilson has clearly never attempted what he writes about. It may be that he just googled "Drupal upgrade nightmare" and read the top results. What is a bit irksome is how Wilson just couldn't resist taking an overdone page from late night talk show monologues by turning Obama's uber buzz-word on its head.

A key point that Wilson misses is the intrinsic nature of Drupal (and many other open-source content management projects): Namely, that it is constantly changing. With countless global contributors that continue to refine and contribute to the codebase, Drupal is an ever-changing and growing platform. Broaden your focus, Chris, and concentrate on the fact that Drupal (and countless other open-source projects) invite the ideas and contributions of the everyman. Does that sound familiar?

Wilson: Drupal is disorganized
McNamara: Um, well, not really. Drupal has countless tools for organizing and categorizing your site's content into a logical and hierarchical structure.

Wilson totally whiffs on this one. He starts by saying that one must search for (it's more like a process of filtering, but close enough) content instead of drilling-down in a filesystem-like hierarchy. Here, he links to this article about a module that seeks to improve the content-filtering process -- isn't that a good thing?

Anyway, he then states that Drupal "doesn't have a convenient way to prevent two people from accidentally editing the same page at the same time", but the thread he links to is about something completely different (it's about ways of improving the management of uploaded files on the server and not the articles/content on one's site). It seems here that Wilson just got lazy on this section of his article, perhaps because of a lack of knowledge of the actual system he's writing about.

Wilson: Drupal is righteous
McNamara: I'm sorry, but a droplet of your spit just flew into my eye. Please calm down.

I'll just say that Wilson is grasping at straws here, and leave it at that.

Wilson goes on to talk about recovery.gov's dropping of Drupal as their CMS. Now, I don't know enough about that, so I'll keep my comments very brief: Drupal isn't the right solution for every project, and sometimes the circumstances or the demands of the client require something else. Given that recovery.gov may have needed more functionality that was specific to the mandate of that governmental agency, it would not be surprising that its management avoided custom module development. However, replacing Drupal with an $18 million solution? Wow, that seems to be almost a compliment that Drupal was there first if you need that much money to replace it!

There's obviously a lot more going on there that Wilson just glossed over for the benefit of his overall argument, which frankly, I'm having trouble understanding.

The last paragraph is the kicker... Wilson states "Drupal looks great in theory". To that, I say: just browse the first few pages of drupal.org and see the countless success stories. I've had the pleasure of working on several of them these past few years. I'm not suggesting that we don't run into speed bumps along the way, but I can safely say that you name any Web content management technology and you can be assured that there will be speed bumps -- some big, some small.

Wilson claims that when put into practice, Drupal "tends to be a bit of a mess". By now we know, is totally unfounded, as he's shown little-to-no knowledge of Drupal. And, the last sentence: "In practice, it tends to be a bit of a mess. Does that sound like any particular form of government to you?", Chris sounds more like a Fox News pundit than an objective tech beat writer. Colorful strands of empty sound bites.

Wilson missed the opportunity to write a great article that likens the current administration to the platform that its website is built upon. Instead of under-researching and mis-representing the shortcomings of Drupal, he could have focused more on the culture of open-source development as a whole, and just how fascinating, exciting, and meaningful the foundational shift of whitehouse.gov is.

Sure, Drupal, much like our government (no matter who's in office), has its flaws, and they deserve to be put under the microscope. The exercise of doing this, examining shortcomings and chasing out bugs, is important and healthy.

Chris, if you are going to critique something, please do your homework. Adding colorful soundbites without substantiating your claims makes you seem more like the Sean Hannity of tech writing, which I wonder if you want to be remembered as by the tech community.

-Conor McNamara

Posted at 08:54 pm by DPCI Bloggers

I agree Drupal isn't perfect for every situation. But the amazing thing about Drupal is that you can change everything in it and fairly easily if you take the time to learn the APIs. Apparently taking time to do things is not a virtue that Chris Wilson possesses.

Thanks for the comment, Travis!

As demonstrated, Javascript can be posted in the node body if the user has the appropriate permissions.

Any clue what the reference http://goodkarmahost.com/tech-help/adding-inline-javascript-to-a-single-... might have be referring to?

Good question. It seems the (admittedly more design-oriented) author of that post hasn't quite wrapped their head around Input Filters. The default "Full html" filter will allow the input of javascript code, as demonstrated above (posted directly to the CMS and not via a PHP include, which the author of that post used). For more complicated scripts or ones re-used throughout the site, however, one would want to implement those at the theme or module level -- in code as opposed to thru the CMS. But that's another can of worms...

The point is that Drupal treats the act of posting javascript code as potentially harmful, so it provides site administrators with tools for granting (and denying) such permissions. It's another example of how secure Drupal is out of the box.

Thanks for the comment! 

Conor, this is a really well-written point-by-point deconstruction of the Slate article - Nicely done! (But I am happy to see that Slate links to you.)

"Drupal can seem "hostile to newcomers""

It takes less than a few days to build a site with Drupal.

Drupal's impenetrability is not so high. To the newcomers : just do it, it's easy, with Views, CCK...

Philippine, Films7

Basically a bad programmer/developer/integrator can even distort a simple PHP form... and make it unusable! And: a lot of things depend on basic things like budget, resources and skills. These matters are complex.

Yes Drupal can be hard to get at first. I remember when I was looking for a cms for my site, I checked Drupal and it appeared to me to be complicated, so I chose another cms. Just to come back to Drupal, because once you take a little time to pass through Drupal jargon you discover a great cms.

Drupal Association Organization Member

Case study

Drupal Consulting for DNAinfo New York City Guide

DPCI provides Drupal consulting to DNAinfo to create the New York Guide, a Website that provides business listings and deals for New York City neighborhoods. > more

All case studies

Press Release

Award Program Showcases Outstanding Examples of Digital Experience Delivery; Winners to be Unveiled at Acquia Engage 2017 more
Alltop, all the top stories